> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mezmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Role-Based Access Control

> Learn how Mezmo roles grant member privileges and how access scopes restrict which log data members can see.

Members are users who have signed up for your Organization. You assign each member one or more [roles](/docs/manage-members) that grant privileges. A role can also carry access scopes that determine which logs the member can see.

## Roles

Roles have default privileges. Mezmo supports four roles:

* **Owner** (`owner`) - Each Mezmo Organization has one owner. The owner can't be restricted, has the most access, and manages both admins and members.
* **Admin** (`admin`) - An Organization can have more than one admin. Admins have the second-highest level of access, can view all logs, and can't have their access restricted.
* **Basic** (`basic`) - Standard members of your Organization (previously called "Member"). Their log access is governed by the access scopes on the roles they hold.
* **Read-only** (`readonly`) - Read-only members can view logs, run searches, view screens, and export lines. They have no permission to make changes.

A member can hold multiple roles.

Review the [Feature Access Matrix](/docs/feature-access-matrix) for a breakdown of each role's privileges.

## Access Scopes

Access scopes are [Log Analysis](/docs/about-mezmo-log-analysis) query strings attached to a role that limit which logs a member holding that role can see. A role can carry up to 10 access-scope queries. A role with no access scopes grants access to everything.

For example, you can add an access-scope query that matches only logs from Node.js applications and attach it to a role. Members who hold that role see only Node.js logs.

You manage roles and their access scopes at [**Settings > Organization > Roles**](https://app.mezmo.com/manage/roles). You can manage access scopes from the Role form and the Roles list:

* In the Role form, **Permissions** and **Access Scopes** appear on separate tabs.
* A role must grant at least one permission or at least one access scope.
* In the Roles list, an **Access Scopes** badge marks any role that has access scopes.
* Use the **Preview** link to test a query against live tail (the real-time streaming view of incoming logs) before you save.

To learn more about query syntax, see [search log contents](/docs/searching-log-contents).

## Create or Edit a Role

1. Go to [**Settings > Organization > Roles**](https://app.mezmo.com/manage/roles).
2. Click **Create Role** to add a role, or click **Edit** next to an existing role.
3. Enter a name for the role.
4. On the **Permissions** tab, select the privileges the role grants.
5. On the **Access Scopes** tab, add up to 10 Log Analysis query strings to limit which logs the role can see. Leave this empty to grant access to everything.
6. Click **Save**.

Use **Preview** to test a query against live tail before you save.