> ## Documentation Index > Fetch the complete documentation index at: https://docs.zionapp.co/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions > Manage built-in and custom roles, review the permission catalog, and read the role change history. Zion assigns every staff account one of three built-in roles administrator, supervisor, or monitor, plus student and parent roles for portal access. Administrators can also create custom roles that layer additional permissions on top of a user's built-in role. This page covers Settings > Roles (`/settings/roles`) and the role change history at `/settings/roles/audit`. Only administrators can reach this area. Custom roles are additive. Assigning one adds permission keys to what a user already has through their built-in role. It never replaces or downgrades a built-in role. ## Built-in roles Every built-in role is mirrored as a seeded, immutable system role so its exact grants show up in the same list as custom roles. | Role | What it can access | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Administrator | Every permission key in the catalog. | | Supervisor | View, create, edit, and delete students; assign PACEs; view and set Goal Check targets; mark completion; view and submit grading; mark and view attendance; view calendar and create centre events; view and generate reports; view and check out inventory. | | Monitor | Same as supervisor, minus deleting students, creating centre calendar events, and inventory access. | | Student | View Goal Check progress and view the calendar. | | Parent | View the calendar. | Supervisors and monitors only see the students, centres, and reports for the learning centres they are assigned to. Administrators see every centre in the organization. For how staff accounts and centre assignments are set up, see Teaching staff and user accounts. ## The permission catalog Custom roles are built from a fixed catalog of permission keys, grouped by area: Students, Goal Check, Grading, Attendance, Calendar, Reports, Settings, Roles & Permissions, and Inventory. Each key controls one specific action, such as viewing student records, marking attendance, or generating reports. Some catalog keys are not yet enforced anywhere in the app (for example, viewing all Goal Check records across centres, or viewing all attendance across centres). The role editor marks these as "Coming soon" and disables them so you cannot grant a permission that has no effect yet. For the full list of permission keys and what each one unlocks, see the role and permission reference. ## Managing custom roles Go to Settings > Roles. The list shows every role in your organization: its name, description, a System badge for the built-in role mirrors, how many permissions it grants, and how many members hold it. Click New role to start from scratch, or Clone an existing role including a system role to make a customizable copy of it. Name the role, add a description, and check the exact permission keys to grant. System roles themselves cannot be renamed or edited directly. Open a user's detail page under Settings > Users and add the custom role under Assigned Roles. You can also bulk-assign or bulk-remove a role across many users at once from the Roles page. On the user's detail page, the Effective Permissions card shows the resolved union of their built-in role and any assigned custom roles, with each key attributed to the role that granted it. Deleting a system role is blocked. Deleting a custom role that is currently held by one or more users shows a warning stating exactly how many users hold it before you confirm. Click the member count on any custom role to see exactly who holds it before editing or deleting it. ## Role change history Settings > Roles includes a link to the audit log at `/settings/roles/audit`. It records every role and permission change made in the organization: who made the change, what changed, and when. The log is paginated with a Load more control and can be filtered by actor. Invite staff, assign centres, and deactivate or reactivate accounts. How centres scope which students and staff a role can see. The full permission catalog and system role bundles. Definitions of roles, centres, and other Zion-specific terms.