> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Your Team

> The three roles Earnie uses to separate who can change the rules from who can work the queue, how to add members, and the full permissions matrix.

## Three Roles, Deliberately

<img src="https://mintcdn.com/scanoss/NhcM_gE6JS5ci757/en/latest/earnie/administration/images/members.png?fit=max&auto=format&n=NhcM_gE6JS5ci757&q=85&s=de00a214bbf08f1fb11aaa060d4fc3df" alt="Members" width="1017" height="635" data-path="en/latest/earnie/administration/images/members.png" />

Three roles, deliberately. Enough to separate who can change the rules from who can work the queue, without a permissions matrix nobody maintains.

| Role         | Can Do                                                                                                |
| ------------ | ----------------------------------------------------------------------------------------------------- |
| **Admin**    | Everything, including SSO, members, integrations, and the audit log.                                  |
| **Operator** | The daily work: projects, scans, triage, policies, and scan configuration. Not organisation settings. |
| **Viewer**   | Read everything they have access to. Records no decisions.                                            |

Add someone from **Settings → Members**; they sign in with your existing SSO, so there's no password to issue.

<Note>
  Roles can be changed at any time. Earnie hides what a role cannot do rather
  than showing disabled buttons, so if a control isn't there, that's why.
</Note>

## Who Can Do What

| Capability                                            | Admin | Operator | Viewer |
| ----------------------------------------------------- | ----- | -------- | ------ |
| View findings, scans, policies                        | ✓     | ✓        | ✓      |
| Run scans                                             | ✓     | ✓        | —      |
| Record triage decisions                               | ✓     | ✓        | —      |
| Create and change policies                            | ✓     | ✓        | —      |
| Request a policy approval                             | ✓     | ✓        | —      |
| Approve or reject a request                           | ✓     | —        | —      |
| Generate SBOM snapshots, render Attribution Documents | ✓     | ✓        | —      |
| Scan configuration                                    | ✓     | ✓        | view   |
| Manage members                                        | ✓     | —        | —      |
| SSO configuration                                     | ✓     | —        | —      |
| Connect / disconnect integrations                     | ✓     | view     | —      |
| Organisation audit log                                | ✓     | —        | —      |
| API keys                                              | all   | own      | —      |

## What's Next

Members aren't the only way to authenticate against Earnie, the next step is setting up [API keys for your pipelines and scripts](/en/latest/earnie/administration/api-keys).