> For the complete documentation index, see [llms.txt](https://docs.cloudeka.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudeka.ai/guidance-for-enterprise/deka-gpu-mlops/role-based-access-control-rbac/add-new-roles.md).
# Add New Roles
**Role-Based Access Control (RBAC)** is a security feature in the Cloudeka Deka MLOps Service Portal that allows administrators to define granular permissions for users.
Instead of assigning permissions directly to users, administrators can create **Roles** that contain a set of permission rules and then assign those roles to users.
This guide describes the process of creating a custom role, configuring its permissions, and managing it through the user interface.
## Navigate to the Roles Management Page
To begin, access the role management section. Click the **Settings** icon in the main navigation sidebar.
On the **Settings** page, select **Roles** to access the role management page.
## Initiate the Role Creation Process
The **Roles** page displays all roles available within the selected namespace. To create a new role, click the **Create Role** button located in the top-right corner of the page.
The **Create New Role** dialog appears, allowing you to define the role name and configure its permissions.
## Define the Role Name and Policy Rules
In the **Create New Role** dialog, enter a descriptive **Role Name**. The role name should clearly represent the function of the users who will be assigned to the role. In this example, the role name is **data-scientist**.
Next, configure the **Policy Rules**. Policy rules define the actions that users can perform on specific resources. Each rule consists of the following components:
* **Resources**: The resources that users can access (e.g., Notebooks, Pipelines, TFJobs). One or more resources can be selected for a single rule.
* **Verbs**: The actions that users are allowed to perform on the selected resources, (e.g., get, list, create, delete).
Use the **+ Add Rule** button to create additional rules.
To configure a rule, click the arrow icon to expand the rule settings.
For our **data-scientist** role, we will configure three distinct rules to grant a specific set of permissions.
**Rule 1: Full Control over Notebooks**
* **Resources**: Select **Notebooks**.
* **Verbs**: Check the boxes for **create**, **get**, **list**, and **delete**. This gives the user full lifecycle control over their notebook servers.
**Rule 2: Permission to Run and View Pipelines**
* **Resources**: Select both **Runs** and **Pipelines**.
* **Verbs**: Check the boxes for **get**, **list**, and **create**. This allows the user to view existing pipelines and execute new runs, but not delete them.
**Rule 3: Read-Only Access to Training Jobs**
* **Resources**: Select both **TFJobs** and **PyTorchJobs**.
* **Verbs**: Check the boxes for **get** and **list**. This allows the user to monitor and view the details of training jobs without being able to create or delete them.
After configuring all required rules, click the **Create Role** button to complete the process.
## Verify and Manage the New Role
After the role is created successfully, you will be returned to the **Roles** page. The newly created **Data Scientist** role appears in the **Existing Roles** list.
In the **Actions** column, the following options are available for managing the role:
a. **Role Details (Eye Icon)**
Click the eye icon to view the role details. The role details page displays basic information, including the role name, namespace, and creation date. It also displays all configured policy rules, allowing you to review the permissions assigned to the role.
b. **Bind Role to User (Chain Icon)**
Click the chain icon to assign the role to a user. A dialog appears displaying the **Role Name** and **Namespace**. Select the desired user from the **User** dropdown list, then click the **Bind User** button. This action creates a role binding and grants the selected user the permissions defined in the role.