> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Team Roles & Permissions

> Understanding team member roles and access levels

Wirespeed uses role-based access control to manage what team members can see and do. There are three roles: **Viewer**, **Analyst**, and **Admin**.

<CardGroup cols={3}>
  <Card title="Viewer" icon="eye">
    Read-only access
  </Card>

  <Card title="Analyst" icon="shield-check">
    Respond to security events
  </Card>

  <Card title="Admin" icon="settings">
    Full platform control
  </Card>
</CardGroup>

***

## Viewer

Read-only access to security data. Best for stakeholders and observers.

**Can**:

* View detections and cases
* View assets (users, endpoints, files, IPs)
* View integrations
* View team settings
* Search the data lake (events)

**Cannot**:

* Update cases or detections
* Create custom detections
* Take remediation actions
* Configure integrations
* Manage team members

***

## Analyst

View and respond to security events. Best for SOC analysts and security engineers.

**Everything Viewers can do, plus**:

* Update cases and detections
* Add case notes and attachments
* Create custom detections
* Take remediation actions (remediate/release users and endpoints)
* Test chat-ops
* Manage integration configuration (for select integrations, once added by an Admin)

**Cannot**:

* Add or remove integrations
* Manage team members
* Manage remediation policies
* Manage exclusions
* Manage asset automations
* Manage verdicts
* Run integration actions

***

## Admin

Full platform control. Best for security team leads and platform administrators.

**Everything Analysts can do, plus**:

* Configure integrations (add, update, delete)
* Manage team members (invite, remove, change roles)
* Manage remediation policies
* Manage exclusions
* Manage asset automations
* Manage verdicts
* Manage chat-ops
* Run integration actions
* Update team settings and billing

<Warning>Only grant Admin access to trusted team leads who need to configure integrations and manage team settings.</Warning>

***

## Managing Roles

### Changing a Team Member's Role

1. Navigate to **Settings** > **Team**
2. Find the team member in the **Team Members** table
3. Click the **three-dot menu** and select **Change Role**
4. Choose Viewer, Analyst, or Admin

<Note>Only Admins can change team member roles.</Note>

***

## Role Comparison

| Permission                           | Viewer | Analyst | Admin |
| ------------------------------------ | :----: | :-----: | :---: |
| **View detections & cases**          |    ✓   |    ✓    |   ✓   |
| **View assets**                      |    ✓   |    ✓    |   ✓   |
| **View integrations**                |    ✓   |    ✓    |   ✓   |
| **View team settings**               |    ✓   |    ✓    |   ✓   |
| **Search the data lake**             |    ✓   |    ✓    |   ✓   |
| **Update cases & detections**        |        |    ✓    |   ✓   |
| **Add case notes**                   |        |    ✓    |   ✓   |
| **Create custom detections**         |        |    ✓    |   ✓   |
| **Take remediation actions**         |        |    ✓    |   ✓   |
| **Test chat-ops**                    |        |    ✓    |   ✓   |
| **Manage integration configuration** |        |    ✓    |   ✓   |
| **Add/remove integrations**          |        |         |   ✓   |
| **Manage team members**              |        |         |   ✓   |
| **Manage remediation policies**      |        |         |   ✓   |
| **Manage exclusions**                |        |         |   ✓   |
| **Manage asset automations**         |        |         |   ✓   |
| **Manage verdicts**                  |        |         |   ✓   |
| **Manage chat-ops**                  |        |         |   ✓   |
| **Run integration actions**          |        |         |   ✓   |

***

## Team API Keys

Team API keys can be created with any role (Viewer, Analyst, or Admin) and have the same permissions as a team member with that role.

To create a team API key:

1. Navigate to **Settings** > **Team**
2. Scroll to **Team API Keys**
3. Provide a **name**, **role**, and **expiration** (1-720 days)
4. Copy and securely store the token (it will only be displayed once)

***

## FAQ

<AccordionGroup>
  <Accordion title="Can a team member have different roles on different teams?">
    Yes. If you're part of multiple teams, you can have different roles on each team.
  </Accordion>

  <Accordion title="Can Viewers see sensitive data like credentials?">
    No. Integration credentials and API keys are never displayed to any role, including Admins. You can only add or update them, not view existing values.
  </Accordion>

  <Accordion title="What happens if I accidentally remove the last Admin?">
    You cannot remove the last Admin from a team. Wirespeed requires at least one Admin per team to ensure the team can be managed.
  </Accordion>
</AccordionGroup>