# Managing Roles & Permissions

Put simply, authorization and RBAC are ways to control what users can see and do in your product. We do this by assigning users roles and permissions, which are set at the org level.

## [Authorization](https://docs.propelauth.com/overview/authorization/managing-roles-permissions#authorization)

You can use PropelAuth to authorize access to your product via both your frontend or backend. For example, you can display information to your users based on their permissions, or create a backend route that is scoped to users in a certain Organization.

## [Roles vs. Permissions](https://docs.propelauth.com/overview/authorization/managing-roles-permissions#roles-vs-permissions)

Roles are something that your users will see. When your users invite their coworkers to your product, they specify a role for you after you join.

Permissions are something that only you will see. They are optional, but can be helpful if you’d rather write code that says “Show the billing page if this user has the **CanViewBilling** permission” instead of “Show the billing page for users with the role **Admin**“.

## [Managing Roles & Permissions within PropelAuth](https://docs.propelauth.com/overview/authorization/managing-roles-permissions#managing-roles-and-permissions-within-propel-auth)

All roles and permissions can be managed from the **Roles and Permissions** page within the PropelAuth admin dashboard.

You can create multiple [Role Mappings](https://docs.propelauth.com/overview/authorization/role-mappings) that contain different mappings of roles to permissions. By default, your project will start with just one.

When you change your roles, if the change is backwards incompatible (removing a role, for example), we’ll automatically migrate existing users/invitations with that role.

## [Internal Roles](https://docs.propelauth.com/overview/authorization/managing-roles-permissions#internal-roles)

Internal roles allow you to add yourself or your employees to organizations without appearing to your users in the [hosted pages](https://docs.propelauth.com/overview/basics/hosted-pages). This allows for secure internal operations while maintaining a clean user experience for your users.

Create an internal role by navigating to the **Roles and Permissions** page, clicking on **Roles**, and then clicking on **New Role**. Then toggle the **Internal Role** option.

Here are some key features regarding internal roles:

- Members with internal roles are hidden to your users but are visible on the organization pages within the dashboard.
- The option to assign internal roles are not available to your users via the hosted pages and can only be assigned in your PropelAuth dashboard.
- Internal Users do **not** contribute to the overall Active Organizations in the **User Insights** page.

## [Multiple Roles Per User](https://docs.propelauth.com/overview/authorization/managing-roles-permissions#multiple-roles-per-user)

By default, PropelAuth allows users to only have one role per Org. With Multiple Roles Per User, you can allow your users to have multiple roles within one organization.

You can convert your project to allow Multiple Roles Per User by navigating to the **Roles & Permissions** page in your PropelAuth Dashboard, clicking on **Roles** followed by **Quick Actions**.

Converting to a multi-role project is a permanent change and cannot be reverted. Reach out to [support@propelauth.com](mailto:support@propelauth.com) if you need any help.

### Allowing Roles to Manage Other Roles

Instead of the hierarchy of roles that we see with **Single Role per User** mode, roles can instead be set to manage other roles. For example, let's say we have three roles:

- Mars Admin
- Mars Member
- Earth Member

We can set **Mars Admin** to manage itself as well as **Mars Member**.

This allows you to then assign permissions to the **Mars Admin** role to:

- Send invitations for the **Mars Member** and **Mars Admin** roles.
- Provision/deprovision the **Mars Member** and **Mars Admin** roles.
- Remove other users with the **Mars Member** and **Mars Admin** roles.

However, they will not have any of these permissions for the **Earth Member** role.