Perimeter uses **roles** to define permissions and **memberships** to assign a role to a person inside a workspace.

In Enterprise, a membership can also be scoped to one organisation. This distinction matters:

- the role says what actions are allowed;
- the membership says where those actions apply; and
- some operational data has an additional consent or visibility gate.

A person can have more than one membership, but permissions never cross tenant boundaries.

## SMB roles

An SMB workspace has four fixed tenant-wide roles.

| Role | What it can do |
| --- | --- |
| **Owner** | Workspace settings, billing, members, invitations, audit, and all SMB operational work |
| **Analyst** | Operational work without member administration, billing, settings, or risk approval |
| **Viewer** | Read-only access to the SMB operational surfaces |
| **Remediator** | Only findings assigned to them and the assets containing those findings; can update and rescan assigned findings |

The Analyst can create and export risk records but cannot approve risk acceptance. This prevents the same operational role from both proposing and approving its own acceptance.

The Remediator restriction is enforced by the API, not only by hiding navigation.

## Enterprise roles

Enterprise uses different built-in roles and adds organisation-scoped administration.

| Role | Scope | What it means |
| --- | --- | --- |
| **Tenant Customer Sysadmin** | Entire tenant | Account administration, organisations, subsidiaries, members, and tenant settings; deliberately no operational-data permissions |
| **Tenant Customer Operator** | Entire tenant | Organisation and licensing administration; read-level operational access only where Operational Visibility permits it |
| **Organisation Sysadmin** | One organisation | Members, custom roles, subsidiaries under its assigned parent, Operational Visibility, and broad operational administration for its organisation scope |
| **Perimeter Tenant Admin** | Internal system role attached to one tenant | Perimeter support administration; operational data still requires a customer-issued temporary grant |

Tenant-wide roles apply across eligible organisations in the tenant. Organisation Sysadmin is attached through an organisation-scoped membership.

## Who can create a subsidiary?

The built-in Enterprise administrative roles contain the **Create subsidiaries** permission, but the selected parent must also be in the membership's authority:

- Tenant Customer Sysadmin, Tenant Customer Operator, and an attached Perimeter Tenant Admin use tenant-wide memberships and can create under eligible organisations in that tenant.
- Organisation Sysadmin can create only under the organisation to which that membership is assigned.
- Permission held for one organisation never authorizes creation under another.

Creation is also bounded by your allowances: the parent must not have reached its subsidiary limit, and the result must stay within the nesting depth your plan or contract includes.

> **Subsidiaries are not one level deep, and not Enterprise-only.** Organisation hierarchy is available from the Professional plan upward, and the number of levels you may nest depends on plan and contract — see [Editions](editions) for the figures.

If the message says **"subsidiary:create permission required on the parent organization"**, check the member's active role and membership scope — not only whether they can see the parent in the organisation tree.

### Moving a subsidiary

A subsidiary can be moved under a different parent. This is a separate action from editing the organisation's other fields, and it re-checks everything creating a subsidiary at the destination would check: your scope on both the source and the destination, **Create subsidiaries** on a membership that actually covers the destination, and the destination's own limit.

It additionally refuses a move that would place an organisation inside its own subtree, which would leave that whole branch unreachable from any root.

## Managing members

Use **Settings → Members** to invite members and choose their role and, where applicable, organisation scope. The interface shows the role's permissions before the invitation is sent.

Existing members can be edited, removed, or have two-factor enrollment reset subject to authorization and last-administrator protections. Pending invitations can be resent or revoked, and invitation tokens are single-use.

## Custom roles

Enterprise Organisation Sysadmins can create organisation-scoped custom roles from the permissions they themselves hold.

- A custom role cannot grant more authority than its creator.
- Built-in roles cannot be edited.
- A role still assigned to members cannot be deleted.
- Custom roles are not silently changed when built-in templates are updated.

Changes to a role's permissions are evaluated from the database on subsequent requests, so an ordinary role edit does not require anyone to sign out.

## Gates that sit on top of permissions

Holding a permission is not always sufficient. Three separate gates can apply.

**Perimeter staff access.** A Perimeter Tenant Admin membership does **not** provide unrestricted access to customer operational data. To authorize support access, a customer administrator issues a time-boxed grant from **Settings → Perimeter Access** for 1–168 hours. The grant can be revoked at any time, and revocation takes effect on the next request. Grant creation, revocation, and use are audited.

**Operational Visibility.** Tenant Customer Operator operational reads are additionally controlled by the root organisation's Operational Visibility setting. This lets the customer separate account and licensing administration from security-data visibility. Organisation Sysadmin is the built-in role allowed to change that setting.

**Scan authorization.** Running an Intrusive scan requires a signed, expiring authorization recorded on the organisation — independent of any role. No permission grants it. See [Running scans](running-scans).

## Audit log

**Settings → Audit** records sensitive actions, including the actor, affected entity, time, and available request context. Filters and CSV export are subject to the caller's tenant or organisation scope.