# Access control (/en/docs/platform/websites/access-control)





Website access decides who can reach one particular site and what they can do there. It is separate from workspace roles, which decide who administers the account.

Find it under the website's **Settings** > **Access control**. You need the website **Admin** role to change it.

## The four roles [#the-four-roles]

Each role includes the permissions of the roles before it.

| Role        | Adds                                                                   |
| ----------- | ---------------------------------------------------------------------- |
| **Viewer**  | Read reports, settings, script inventory, and alerts                   |
| **Analyst** | Decide on scripts under review, justify or reject                      |
| **Manager** | Change the website's configuration, ingestion, alerts, tags, and rules |
| **Admin**   | Manage access to the site and delete it                                |

The split between Viewer and Analyst is the one that matters most in practice. PCI DSS script review is an approval decision with an audit trail attached, so **Analyst** is the lowest role that can justify or reject a script. Give it to the people who own that judgement and leave everyone else on Viewer.

The split between Manager and Admin separates configuring a site from controlling who else can reach it.

The access control page keeps people and groups in separate tables:

<img alt="The website access control page with a People table and a Groups table" src="__img0" width="1359" height="645" />

## Grant access to a person [#grant-access-to-a-person]

Under **People**, select **Add people**, choose a workspace member, and pick a role. Change someone's role later from the dropdown on their row.

Only existing workspace members appear in the picker. To bring in someone new, invite them to the workspace first under [Team](/en/docs/platform/team/invitations), then grant them the site.

## Grant access to a group [#grant-access-to-a-group]

Under **Groups**, select **Add group** and pick a role. Every member of that group inherits the role on this website.

Groups are the better default once you have more than a handful of people. Granting `Security` the Analyst role on every payment-facing site, then managing membership in one place, beats maintaining per-person grants across a dozen websites. For more information, refer to [Groups](/en/docs/platform/team/groups).

## How the two systems interact [#how-the-two-systems-interact]

Two rules, and they cover every case.

**Workspace owners and admins already have full access to every website.** They are website Admin everywhere, automatically. You cannot grant them less by leaving them off the list, and adding them explicitly changes nothing. If you need someone restricted to certain sites, they must be a workspace **Member**, not an admin.

**Everyone else gets the highest role they hold.** If someone has a direct Viewer grant and belongs to a group with Manager, they are a Manager. Removing one path does not remove the other, so when you are revoking access, check both the People and Groups lists.

## Revoke access [#revoke-access]

Use the row menu to remove a person or a group. Removing a group removes it for every member who was inheriting through it, which is exactly the point, and worth confirming before you do it on a large group.

Removing someone from the workspace entirely removes all their website grants along with them.

## Next steps [#next-steps]

* [Roles and permissions](/en/docs/platform/team/roles-and-permissions)
* [Groups](/en/docs/platform/team/groups)
* [General settings](/en/docs/platform/websites/general-settings)