--- title: "What is a Role" slug: "what-is-a-role" description: "What are roles in Clarity, and how are they used to help with audits?" tags: ["Roles", "About"] updated: 2025-05-06T18:27:20Z published: 2025-05-06T18:27:20Z canonical: "help.claritysecurity.com/what-is-a-role" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.claritysecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # What is a Role? Roles in Clarity are based on the concept of Role Based Access Control (RBAC). Roles can be either automatically generated based on chosen attributes (default) or customized by hand. An example of a standard Role Based Access Control setup would be utilizing Department and Job Title Attributes from a Source of Truth application. This configuration would allow you to assign permissions to users at the Department level and Job Title level, resulting in user access comprising a set of permissions from the Department role and a set of permissions from the Department\Job Title role. > [!TIP] > Check out these other Articles to learn more about building and reviewing roles > > [Building Roles](/docs/building-roles) > > [Role Reviews](/docs/role-reviews) --- ## Topics we will cover: - [What generates roles](/v1/docs/what-is-a-role#what-generates-roles) - [Access from a Role](/v1/docs/what-is-a-role#access-from-a-role) - [Creating, modifying, and deleting roles](/v1/docs/what-is-a-role#creating-modifying-and-deleting-roles) - [Role purge and rebuild](/v1/docs/what-is-a-role#role-purge-and-rebuild) - [Special Roles](/v1/docs/what-is-a-role#special-roles) - [Where the data comes from](/v1/docs/what-is-a-role#where-the-data-comes-from) --- ## What generates roles By default, Clarity will generate roles based on attributes that you define in the Organizational Units section of the settings page. The attributes you select should be from a Source of Truth Downstream Application which can organize the users in your organization in a helpful and logical way. A typical method is to use a "Department > Job Title" structure since users in the same department often have similar access requirements to organizational tools and users with the same Job Title typically have a very high degree of access overlap. Note If you have the same job title in two different departments, these will be considered different roles, since their parent role (Department) is different. **HR\Manager** vs **Sales\Manager** --- ## Access from a Role Entitlements outlined in a role define the expected entitlements for a member of your organization; in addition, if you use Clarity for Lifecycle Management then a role also defines the base level of access an Identity would receive if someone is hired or moves to the role. Each Entitlement an Identity has will either be **role** or **exception** for its Grant Type (depicted below). ![Grant Type.png](https://cdn.document360.io/2d020999-1823-4d4d-b6d2-4b52fb4a9617/Images/Documentation/Grant%20Type.png?sv=2026-02-06&spr=https&st=2026-11-10T23%3A37%3A54Z&se=2026-11-11T00%3A37%3A54Z&sr=c&sp=r&sig=spFP4rMK2AWr9jhi6%2FH8BV%2FI9APdk3lL7O611kVPp6g%3D) ### Grant Type: Role If you are viewing an Identity's Entitlements (depicted above), and you see Grant Type **role**, this would indicate that the Entitlement is part of the the Identity's roles (an Identity typically has at least 2 roles, Department and Department/Job Title). ### Grant Type: Exception If an Identity has any Entitlements that are not associated with their role, then Clarity will mark these with the Grant Type **exception**. This is to indicate that the Identity has the Entitlement, but it is an exception to the entitlements outlined in their roles. ## Creating, modifying, and deleting roles Clarity allows for the creation and modification of existing roles in Clarity. ### Creating While typically Roles are generated from the attributes you select, you can create custom roles in the UI if it is necessary for your environment or you plan to combine (alias) other roles under another. Roles can also be created by using the Clone feature, this lets you clone an existing role to create a new role with the same entitlements. ### Modifying Roles can be modified in several ways including: combining, renaming, tagging. **Combining** a role into another role create an alias relationship in the database, which tells any member of role B (an alias of role A) that they should be treated as a member of role A. **Renaming** a role creates a new role with the desired name, and then makes the original role an alias of the newly created role with the desired name. **Tagging** a role lets you use filtering and perform reviews against particular roles. Similar to tagging, you can also flag a Role as High Risk. ### Deleting At this time, clarity does not allow for deleting roles from the User Interface. You can contact your Clarity Support team if a role was created incorrectly or needs to be deleted. --- ## Role purge and rebuild Role structures can be completely restarted from scratch by using the Purge and Rebuild Options in the settings menu. This lets you completely rebuild your Role Based Access Control structure and perform the role-mining process from the beginning. This is particularly helpful if you are initially setting up Clarity, completely reorganizing your company, or simply need to change which Organizational Units your Role Based Access Control is based on. --- ## Special Roles **Global (Everyone)** - This role is always present, and cannot be removed. Every identity in Clarity is a member of this role and can be used to provide all Active Identities with an entitlement you specify. **Default or Intermediary/Default** - For any identities that exist in Clarity, but are missing a valid attribute (for the corresponding Organizational Units), a role (intermediary or terminal) will be generated using **Default**. Check out the examples below for more details on roles generated with the name **Default**. Examples of **Default** roles 1. If an Identity is missing the Department attribute, but has the Job Title **Senior Developer**, they would receive the role **Default/Senior Developer**. 2. If an Identity is missing the Job Title attribute, but has the Department **Accounting**, they would be assigned the **Accounting/Default** role. 3. If an Identity is missing both Department and Job Title attributes, they would be added to the **Default/Default** role. --- ## Where the data comes from The data for Roles predominantly comes from the role-mining process. This process starts with first selecting your hierarchical Organizational Units to define your Role Based Access Control structure. Once this is complete (and Role building is enabled or triggered) then your Role structure will be generated. After your roles are generated, Clarity will then iterate through all the entitlements from every user in each role, and create a list of common entitlements (entitlements that every member of the role is assigned). This creates the base of your Role Based Access Control and should be further improved by your Clarity Administrators. Tip: Any easy way for to improve the accuracy of the Entitlements in your roles, is to review the Entitlement Suggestions for your organization's role. In addition to the initial role mining process, roles can be customized manually as indicated in the [Creating, modifying, and deleting roles](/v1/docs/what-is-a-role#creating-modifying-and-deleting-roles) section of this article. --- ## Need help? If you have any problems, contact your customer success team. You can also get in touch with our general support [via email](mailto:support@claritysecurity.io), open a [support ticket](https://support.claritysecurity.com/home). Our general support team is available Monday - Friday from 8:00 AM - 6:30 PM CST. Role Based Access Control is an approach to managing access by provisioning pre-approved access based on an Identity's function within an organization. An attribute is a piece of information used to describe a service user, entitlement, or identity. Common examples include First Name, Last Name, Job Title, Department, etc. Organizational Units are a top down hierarchical structure used to generate Roles in Clarity. A Downstream Application is any application that supplies Clarity with service users, entitlements, and attributes. Lifecycle Management refers to the processes that handle an employee's journey from on-boarding to off-boarding. This can also be defined by the terms Joiner, Mover, and Leaver. An Entitlement is an assignable permission found in a downstream application. Common examples include licenses, groups, and policies. Grant Type details how an Identity received access to an entitlement, either through a role or as an exception to its role. High-Risk is flag used to denote Entitlements or Roles that have an elevated level of risk and require additional attention and review. Entitlements: - **Entitlements** > **Filter by App** > **Choose Entitlement** > **Gear Icon** - **Entitlements** > **Bulk Edit** > **High Risk Column** Roles: - **Roles** > **Click your Role** > **Manage** > **Gear Icon** - **Roles** > **Bulk Edit** > **High Risk Column** Role Based Access Control is an approach to managing access by provisioning pre-approved access based on an Identity's function within an organization. This is an automatically generated list of entitlements that a significant percentage of the role members have in common. You may want to consider making this entitlement part of the role. This is found in the **Manage** page of an individual role. ## Related - [Building Roles](/building-roles.md) - [Role Reviews](/role-reviews.md)