Limited availability
Role groups are in pilot phase. Some of the processes and documentation may change as the feature evolves.
Role groups let you bundle multiple individual roles into a single package that you can assign to users. Instead of assigning roles one by one, create a role group based on a job function, such as "Finance team" or "Risk analyst", and assign it to everyone who needs the same access. This helps keep permissions consistent and makes user management easier as your organization grows.
Requirements
Before you begin, make sure that you meet the following requirements:
| Requirement | Description |
|---|---|
| User role | You need the Merchant admin or IAM admin role. |
| Account level | Role groups are managed at the company level in your Customer Area. |
Admin tiers
There are two tiers of admin access for managing users and permissions. The tier determines what an admin can do with role groups and individual roles:
| Admin tier | Roles in this tier | User management scope | Role group management |
|---|---|---|---|
| Full admin | Merchant admin, IAM admin (with company-level access) | Assign all roles and role groups available in the company account to users. | Create, edit, and delete role groups. |
| Limited admin | Merchant user management | Assign only the roles and role groups that this admin already has. | Cannot create, edit, or delete role groups. Can assign role groups from the User details page. |
The Merchant admin role includes full user management alongside other administrative permissions, such as risk configuration and payment method management. If a user only needs to manage roles and role groups without those extra operational permissions, assign them the IAM admin role instead.
A Merchant admin user without company-level access has the same user management scope as a limited admin. The full admin tier requires company-level access.
If you need permissions that neither you nor your full admin have, reach out to our Support Team.
Role groups and individual roles
You can assign permissions to a user through role groups, individual roles, or a combination of both. The user receives the combined permissions from all assigned role groups and individual roles.
For example, if a user has:
- A role group called "Finance team" that contains the Merchant financial and Download reports roles.
- An individually assigned View Payments role.
The user has the permissions from all three roles.
When you update a role group, the changes apply to all users that have the role group. For example, if you add the Merchant report role to the "Finance team" role group, all users with this role group receive the Merchant report permissions.
How it works
The following is an overview of how to set up and use role groups:
- You create a role group and select which individual roles to include.
- You assign the role group to one or more users.
- Each user receives the combined permissions from the role group and any individually assigned roles.
- When you update the role group, all users with that role group receive the updated permissions.
Create a role group
You need full admin access to create a role group.
To create a role group:
- Log in to your Customer Area.
- Go to Account > Role groups.
- Select Create role group.
- On the Details step, enter a Name for the role group, and optionally add a Description. Select Continue.
- On the Roles step, expand a role category and select the roles that you want to include. You can select roles from multiple categories. Select Continue.
- Optionally, on the Users step, search for and select users that you want to assign to this role group. Select Continue.
- On the Summary step, review the details, roles, and users. To make changes, select the edit icon next to a section.
- Select Create group.
Assign a role group to a user
Both full and limited admins can assign role groups to users. Limited admins can assign role groups from the User details page, but cannot create, edit, or delete role groups.
You can assign role groups when you create a new user, or add them to an existing user.
To assign a role group to an existing user:
- Log in to your Customer Area.
- Go to Account > Users, and select the user from the User List.
- In the Role groups section, select the role groups to assign. You can only assign role groups that contain roles your own user already has.
- Select Save.
The user now has the permissions from all roles in the assigned role groups, in addition to any individually assigned roles.
Edit a role group
You need full admin access to edit a role group. When you edit a role group, the changes apply to all users that have this role group.
To edit a role group:
- Log in to your Customer Area.
- Go to Account > Role groups, and select the role group that you want to edit.
- Make your changes to the name, description, or included roles.
- Select Save.
When you remove a role from a role group, users who have that role only through this role group lose the corresponding permissions. Users who also have the role assigned individually are not affected.
Delete a role group
You need full admin access to delete a role group. Before you delete a role group, check which users have this role group assigned to them. Users who have roles only through this role group lose those permissions after deletion.
To delete a role group:
- Log in to your Customer Area.
- Go to Account > Role groups, and select the role group that you want to delete.
- Select Delete role group.
- Review the list of affected users, and then select Delete to confirm.