> For the complete documentation index, see [llms.txt](https://docs.limio.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.limio.com/support/user-permissions-and-administration/how-to-create-and-manage-users-teams-and-permissions.md). # Users and Permissions To manage users and permissions, click your avatar in the top right corner, then click **Profile**. The left menu shows the **Profile**, **Users**, **Create User** and **Permissions** tabs. ## **Roles** Limio uses role-based access control (RBAC). Each user has one role, and the role holds the permissions. To change what a user can do, change the permissions of their role, or give the user a different role. The default roles are: * **Tenant Administrator** For the users who administer Limio. * **Manager** For the users who approve and publish pages. * **Editor** For the users who work on pages. * **Viewer** For the users who only look at information in the Limio catalog. These roles are starting points. An administrator can change the permissions of each default role. ## **How Permissions Work** Each role has two layers of permissions: **Application access** and **Data permissions**. The **Permissions** tab shows each layer in its own table. ### **Application access** Application access is the feature layer. It controls which parts of the Limio app a user sees, and which main functions a user can use. Each feature is on or off. Examples of features are "Promo Codes", "Publishing & Unpublishing", "Export Data" and "User Management". For the full list of features and what each one controls, see [Application Access Features](/support/user-permissions-and-administration/how-to-create-and-manage-users-teams-and-permissions/application-access-features.md). ### **Data permissions** Data permissions are the data layer. This layer controls what a user can do with each record type, such as offers, pages, promo codes and users. Each record type has three permissions: * **Can Read** - the user can see records of this type. * **Can Write** - the user can create and edit records of this type. * **Can Delete** - the user can delete records of this type. Limio applies the data layer to every action on a record. This includes each action in the Limio app, each internal action, and each request to the generic Limio APIs. **Can Delete** is off by default for every role, the Tenant Administrator role included. To let a role delete records of a type, turn on **Can Delete** for that record type. ### **The two layers work together** A feature permission does not give access to the data under that feature. A user needs both layers: * The feature, to get access to that part of the app. * The data permission, to read, write or delete the records in it. For example, the "Promo Codes" feature shows the Promo Codes page in the menu. To see the promo codes on that page, the role also needs **Can Read** on promo codes. To create or edit a promo code, the role needs **Can Write**. To delete a promo code, the role needs **Can Delete**. ### **Permissions of the MCP server** The [Limio MCP server](https://docs.limio.com/product/mcp-server/mcp-server) uses the permissions of the user who connects to it. An AI tool on the MCP server can do only what that user can do in Limio. To give the MCP server fewer permissions than your own user, create a separate user for the MCP server. Give that user a role with only the features and data permissions that the MCP server needs, and turn on MCP access for that user. Then connect the AI tool with that user. You can then control the permissions of the MCP server separately from your own. ## **Profile** The **Profile** tab shows your username and role. On this tab, you can change your first name, last name and email. ## **Users** The **Users** tab shows all the users of your environment. To manage users, a role needs the "User Management" feature and data permissions on the **Users** record type: * **Can Read** shows the list of users. * **Can Write** lets the user create users, and edit the name, email, role and MCP access of other users. * **Can Delete** lets the user delete users. ## **Create User** On the **Create User** tab, enter the username, first name, last name and email of the new user. Then select a role. Limio sends the new user an email with a link to activate their account. For the username, add the environment name to the email address. For example, if your address is "" and the environment is "brand-dev.prod.limio.com", use "". This helps users who use more than one Limio environment, for example staging and production. For more detail see: [Set Up a New User](/support/user-permissions-and-administration/how-to-set-up-a-new-user.md) ## **Change the Permissions of a Role** To change permissions, a role needs the "Roles & Permissions" feature. Without this feature, the **Permissions** tab is read-only. 1. Open the **Permissions** tab. 2. Select the role on the left side. 3. Under **Application access**, turn on each feature that the role needs. 4. Under **Data permissions**, turn on **Can Read**, **Can Write** or **Can Delete** for each record type that the role needs. 5. Click **Save**. To see the earlier changes to the permissions, click **View Changes**. ## **Custom Roles** A custom role starts with a copy of the permissions of a role that you select. 1. Open the **Permissions** tab. 2. Click **Add Role**. 3. Enter the Role ID, the Role Name and the Role Description. 4. Select the role to copy the permissions from. 5. Click **Create**. 6. Click **Save**. The new role shows on the left side. Change its permissions, then give the role to users. You can edit or delete a custom role from the left side. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.limio.com/support/user-permissions-and-administration/how-to-create-and-manage-users-teams-and-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.