# Assigning and Creating Security Roles in the GMC

HTML version: [Assigning and Creating Security Roles in the GMC](https://support.gladstonesoftware.cloud/gladstone360/assigning-and-creating-security-roles-in-the-gmc)

## Problem
Administrators need to give staff the right Gladstone 360 and Operator security roles, create new roles and change what each role allows, using Security Configuration in the Gladstone Management Console (GMC).

## Resolution

### Before you start

1. **Create the user account first**
   - User accounts are created in **Operator** (`Configuration > Users > +`), given a Plus2 user group in Plus2 if they use Plus2, and then given their 360 and Operator roles here. See [Managing Gladstone 360 User Accounts and Passwords](managing-gladstone-360-user-accounts-and-passwords.md).

2. **Check you can open Security Configuration**
   - To see **Security Configuration**, a user needs the **Security Admin** role (usually given to the site administrator at installation) as well as GMC access.

### Assign roles to one user (Users)

Best for new starters.

3. **Open Users**
   - Go to `GMC > Security Configuration > Users`. Columns: User ID, Name, Current Roles, Site Group, Status.

4. **Find the user**
   - Search in **Filter by Name or ID**, or filter by **Role**, **Site Group** or **Status**, then select **Search**.

5. **Edit the user**
   - Click the edit icon (or ellipsis) on the user.
   - Optionally filter the left list by application.

6. **Add or remove roles**
   - Select a role on the left and **Add Selected** (Ctrl-click for several; **Add All** adds every role).
   - Remove with **Remove Selected** / **Remove All**.

7. **Save and test**
   - Select **Save**, then test with the user's own account.

### Assign many users to a role (Roles)

Quicker for initial set-up.

8. **Open Roles and pick the role**
   - Go to `GMC > Security Configuration > Roles` and pick the role from the drop-down to see its current users.

9. **Add users**
   - Select users on the left (Ctrl-click for several) and **Add Selected**, or **Add All**.

10. **Save and test**
    - Select **Save**. Sample-test a user from each team.

### Create a role

11. **Create a blank role (option 1)**
    - Go to `Roles > Create New Role`, choose the application in **Select Application**, enter **New Role Name** and **Save**.
    - The new role has every permission set to **Deny**.

12. **Copy an existing role (option 2)**
    - Go to `Permissions`, pick an existing role from the **Roles** drop-down and click **Save As**. Give the new name and **Save**.
    - The permissions are copied, ready to adjust. Best for a tier just above an existing role (for example duty managers who authorise refunds).

### Edit a role's permissions

13. **Select the role**
    - Go to `GMC > Security Configuration > Permissions` and select the role. Permissions are the individual items that make up a **role**, and each role belongs to one application (for example Contacts, POS, Access, Operator).

14. **Set each permission to one of four states**
    - Expand each element heading and set each permission:

    | State | Meaning |
    |---|---|
    | **Allow** | Grants access to the element. |
    | **Deny** | Denies access to the element. |
    | **Current Site** | Allows access only at the site the user is currently assigned to. |
    | **Site Group** | Allows access across the site group the user is assigned to. |

    - The **Global** heading at the top of a role's permissions applies one state to every permission in every element at once.
    - On the element headings, a **solid** coloured option button means every permission in that element has the same state; an **outlined** button means the element contains a mix.

15. **Save**
    - Select **Save**. Users must **log out and back in** for the change to take effect.

## Notes

- **One role per application**: if a user holds more than one role for the same application, the role with the **least access** is used (for example a user with both an Admin and a Standard role for Contacts gets Standard).
- Installation provides two roles per module, for example **Contacts Admin** / **Contacts Standard** and **POS Admin** / **POS Standard**. More can be created.
- **Plus2**: granular Plus2 permissions are managed in Plus2 user groups. The GMC only decides whether a user can log in to Plus2.
- **Operator roles** assigned here control Go Operator **Centre Management**, including Block Bookings and booking exceptions. Block Bookings itself is switched on for your site by Gladstone; contact Gladstone Support. The role matrix is in [Gladstone 360 Access, Operator and System Role Permissions](gladstone-360-access-operator-and-system-role-permissions.md) and [Block Booking Permissions in Go Operator](../gooperator/block-booking-permissions-in-go-operator.md); see also [Configuring Access to Centre Management](../gooperator/configuring-access-to-centre-management.md).
- **Service accounts**: entries named *service* are system accounts. Don't give them to users.
- Prerequisites listed in 2013 documentation: GMC 1.6 or later, Security Services 1.0.23 or later, and Plus2 10.3 or later with strong passwords on.
- If saving permissions shows a script error, re-save in smaller changes and report it to support with a screenshot.
- What each individual permission does: [Gladstone 360 Permission Reference Overview](gladstone-360-permission-reference-contacts-pos-and-check-in.md).
- Which roles to create and what each should allow: [Recommended Gladstone 360 Roles and Permission Levels](recommended-gladstone-360-roles-and-permission-levels.md).
- Related: [Accessing the Gladstone Management Console (GMC)](accessing-the-gladstone-management-console-gmc.md); [Setting Password Complexity in the GMC](setting-password-complexity-in-the-gmc.md).