# Understand permissions and sharing

Distinguish creation roles, object access and administrative permissions.

> **Access:** member. Subject to enabled modules and your plan.

## Check two levels

**Roles** authorize actions within the organization. **Object permissions** allow reading, editing or administering a specific resource. A creation role does not automatically grant access to every existing resource.

| User role | Main capability |
|---|---|
| User | Read shared resources. |
| Organization admin | Administer the organization and members. |
| Vendor creation | Create and manage vendors according to granted access. |
| Assessment creation | Create and manage assessments. |
| Questionnaire creation | Create and manage questionnaires. |
| Activity creation | Create and manage activities. |
| Tool creation | Access corresponding tooling and security operations. |
| Portal user | Answer assigned questionnaires. |

## Check permissions

1. Open **My company → Rights & Roles**.
2. Review invitation permissions and offered roles.
3. Check the person’s and their teams’ permissions.
4. Open sharing on the affected resource to check its specific access.

![Permissions and role settings](https://docs.cisapp.eu/images/en/permissions.webp)

*Organization permissions and resource access work together. · [Open full-size screenshot](https://docs.cisapp.eu/images/en/permissions.webp)*

## Share a resource

In sharing or the access step, choose a person or team and the necessary level: read, write or administration depending on the object. Check an external invitation’s scope before confirming.

## If access is refused

Check the organization, role, object access and module activation in that order. Billing, connectors, incidents and ASM functionality can have specific permissions. Request appropriate access rather than sharing an account.

## Expected outcome

Members have the required role and resources are shared with the intended people or teams.