# Member Roles

> Understand baseline membership levels and additional IAM access.

Every member has one baseline organisation membership level. Assign the lowest level that lets someone do their work, then use additional IAM roles and groups for narrower product-specific responsibilities.

## Role Summary

<table>
<thead>
  <tr>
    <th>
      Role
    </th>
    
    <th>
      Use for
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Owner
      </strong>
    </td>
    
    <td>
      Trusted people responsible for organisation settings, access administration, and assigning or removing Owner access.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Admin
      </strong>
    </td>
    
    <td>
      People who manage members, invitations, IAM configuration, and day-to-day organisation administration.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Member
      </strong>
    </td>
    
    <td>
      People who need baseline read access to organisation resources but should not manage organisation-wide settings or access.
    </td>
  </tr>
</tbody>
</table>

## Change a Membership Level

1. Open **Access management** > **Members**.
2. Select **Manage access** beside the member.
3. In **Membership level**, choose the new level.
4. Select **Save membership level**.

Admins and owners can change eligible membership levels. Only owners can assign the Owner level or remove Owner access from another member.

## Owner Access

Keep at least one active owner in every organisation. Owner access should be limited to trusted people who are responsible for organisation administration.

Before assigning Owner access, confirm the person should be able to manage high-impact organisation settings and owner-level access.

## Groups and Role Assignments

Membership levels are the simplest way to control baseline organisation administration. They are separate from additional IAM roles. A member can have one membership level and any number of compatible direct or group-inherited roles.

Use **Access management** > **Groups** to create reusable groups. Use **Access management** > **Roles** to review the roles available to the active organisation. The roles list labels each role by type:

- **Organisation role**: owned by the active organisation and editable by role administrators.
- **Shared template**: provided by Infuse. Templates can be assigned directly or cloned, but not edited.
- **System role**: managed by Infuse and shown read-only. System roles cannot be assigned from your organisation.

Infuse provides shared role templates for common IoT responsibilities. Every template can be assigned to users and service accounts.

<table>
<thead>
  <tr>
    <th>
      Role
    </th>
    
    <th>
      Intended access
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        IoT Viewer
      </strong>
    </td>
    
    <td>
      View IoT applications, boards, devices, and networks, including device RPC history. Cannot dispatch commands or change devices.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Device Operator
      </strong>
    </td>
    
    <td>
      IoT Viewer access plus device configuration updates such as metadata. Does not include device control.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Device Controller
      </strong>
    </td>
    
    <td>
      IoT Viewer access plus device control: dispatch RPCs, access device keys, and update or cancel device KV, logging, and application operations.
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        IoT Admin
      </strong>
    </td>
    
    <td>
      All organisation-level IoT permissions, including creating and updating applications, boards, and networks.
    </td>
  </tr>
</tbody>
</table>

**Device Controller** was previously named **Command Operator**. Existing assignments were kept when the role was renamed.

Shared templates are read-only. Clone one from **Access management** > **Roles** when your organisation needs a customised version.

To verify the combined result, open **Access management** > **Members**, select **Manage access** or **View access**, and review **Effective permissions**.

For more detail, see [Users, Groups, and Roles](/docs/iam-and-access/users-groups-and-roles).