# Gladstone 360 Access, Operator and System Role Permissions

HTML version: [Gladstone 360 Access, Operator and System Role Permissions](https://support.gladstonesoftware.cloud/gladstone360/gladstone-360-access-operator-and-system-role-permissions)

## Problem
You need to know what the Access, Operator and Security Admin roles in the GMC control, including which Operator role lets a user create, edit or cancel block bookings in Centre Management.

## Resolution

These roles are set in `GMC > Security Configuration > Permissions`.

1. **Access roles**
   - **Access** roles (Access Admin/Standard) cover checking whether a member is allowed entry, viewing, editing and deleting screen layouts, PC settings, **Apply entry overrides**, **Record multiple attendances**, and a legacy *Heartbeat* permission.

2. **Security Admin**
   - **Security Admin** is needed to see **Security Configuration** in the GMC.

3. **Operator roles**
   - **Operator** roles control Go Operator **Centre Management**, including Block Bookings.
   - The permissions are Global, Centre Management, Access Centre Management, Create/Read/Update/Delete **Block Bookings**, Create/Read/Update/Delete **Booking Exceptions**, Configuration and Operator.

   | Role | What is allowed |
   |---|---|
   | **Operator Admin: Admin** | Everything |
   | **Operator Standard: Standard** | Everything |
   | **Operator Admin: Advanced** | Centre Management, Access Centre Management and all Block Booking and Booking Exception permissions; **Global, Configuration and Operator denied** |
   | **Operator Standard: Limited** | Only Access Centre Management and the two **Read** permissions |

4. **Give each user one Operator role**
   - Combining roles (e.g. Limited plus Advanced) lets the restrictive role suppress Configuration access.
   - Without Create/Update/Delete, **Edit Booking** and **Cancel Booking** are disabled even though Read shows full detail.

## Notes

- The Operator Admin: Advanced settings above have been confirmed against the GMC; Global, Configuration and Operator are denied by design.
- Entries named *service* (BPM, Windows service, access application/service) are system accounts and are given to no users.
- No official Access permission list is published; recommended settings are in [Recommended Gladstone 360 Roles and Permission Levels](recommended-gladstone-360-roles-and-permission-levels.md). Entry points are covered in [Access Control – Entry Points and Entry Point Profiles](access-control-entry-points-and-entry-point-profiles.md).
- The full block-booking role matrix and troubleshooting are in [Block Booking Permissions in Go Operator](../gooperator/block-booking-permissions-in-go-operator.md) and [Troubleshooting Block Bookings in Go Operator](../gooperator/troubleshooting-block-bookings-in-go-operator.md). Legacy Plus2 hosted reservations are in [Block Bookings (Plus2 Hosted Reservations) and Invoicing](../gooperator/block-bookings-plus2-hosted-reservations-and-invoicing.md).
- Related: [Gladstone 360 Permission Reference Overview](gladstone-360-permission-reference-contacts-pos-and-check-in.md); [Assigning and Creating Security Roles in the GMC](assigning-and-creating-security-roles-in-the-gmc.md).