# Business Account Roles and Scoped Roles

Owner, Admin, Content Manager, and Viewer roles, plus custom roles with the permissions you pick, each scopeable to one brand, network, or community.

Business Account roles decide what each person on your team can see and change in your Business Account. Genuin proposes your team from your company type and the people in your email domain's directory, when it's connected. Each teammate gets the access they need and nothing more.

[Octo](https://begenuin.com/developers/get-started/any-business/octo-operates-your-business-account-octo-proposes-you-approve), Genuin's Supervised Intelligence interface in your Business Account, proposes this capability when it finds a fit on your sites and apps. It completes the steps under Set it up from your brand context. Nothing goes live until you approve it. It's part of [Control](https://begenuin.com/developers/browse-by-products/control/control-what-it-does-and-where-to-start), and [Control: roles, moderation, brand safety, and guidelines](https://begenuin.com/developers/get-started/any-business/control-roles-moderation-brand-safety-and-guidelines) explains how team roles differ from the roles creators and partners hold.

## When to use it

Use it for any team larger than one. Agencies and holding companies use scoped roles to run several brands from one Business Account.

Holding companies can also get access to their house brands through a network relationship in **Manage** > **Network**. Once a **House Brand** relationship is **Active**, the house brand appears in the holding company's brand switcher.

The holding company then has admin access to that house brand. While the relationship is **Invite Sent** or **Rejected**, it can't switch into it.

Some roles carry specific rights across Genuin:

| Role | What it covers |
| --- | --- |
| Owner | Signs agreements and changes billing; only Owners can do either |
| Content Manager | Owns the moderation queue. In Ad Configuration, it can view and edit presets but can't delete custom presets |
| Revenue, a custom role | Approves partners, reads payouts, and gets alerts when an ads.txt line disappears |
| Developer, a custom role | Often owns the embed and auto login, and gets email when the API or SDKs change |
| Viewer | Read-only access |

## How it works

- The proposal has one Owner, plus Admin, Content Manager, Viewer, and any custom roles your team needs. Each role is scoped to the brands it needs to see.
- Each invitation is drafted with a tour matched to its role. Where your policy or plan calls for it, two-factor authentication is proposed as required.
- In a multi-brand Business Account, the brand switcher moves between brands, and roles can be scoped per brand or per community. [Communities and groups](https://begenuin.com/developers/get-started/any-business/brand-communities-and-groups-structure-content-for-relevance) explains the structure.
- Choosing a brand in the brand switcher switches every module to that brand. When someone gives you access to a brand, it appears in your brand list.
- Team roles cover your staff. Creators, partners, and buyers get [community roles and creator tiers](https://begenuin.com/developers/browse-by-products/control/community-roles-and-creator-tiers) instead.
- Octo acts only with the permissions of the role using it.
- Roles apply when a person signs in. Business Account shows them only the modules and options their role allows.
- Record who owns what under **Brand** > **Context**. Approvals and support requests then reach the right person.

## Set it up

Octo proposes the team with these steps already done. You review the result and confirm it.

1. Invite each teammate under **Settings** > **Manage Brand Users** with **Invite Users**. Learn how in [Invite your team and assign roles](https://begenuin.com/developers/get-started/any-business/invite-team-assign-roles).
2. Pick a role for each person, and add a scope when the role covers one brand, network, or community. Click **Invite** to send the invitations.
3. Review each change in the audit log. [Audit Log, Two-Factor, and SSO for your Business Account](https://begenuin.com/developers/browse-by-products/control/audit-log-two-factor-and-sso-for-business-account) covers the log and its export.

In the **Invite Users** panel, you can enter several email addresses and assign them one role. Business Account rejects invalid emails, duplicates, existing users, and emails with a pending invite.

**Preview Template** shows the invitation email before you send it. You can also create a new role from the same panel.

Invited teammates show as **Pending** until they accept, then as **Active**. A pending invite's three-dot menu offers **Copy Email** and **Resend Invite**.

## Settings

| Setting | What it controls |
| --- | --- |
| Role | Admin, Content Manager, Viewer, or a custom role |
| Scope | Optional; limits the role to one brand, network, or community |
| Two-factor requirement | Whether the teammate signs in with two-factor authentication |

Add, remove, or re-scope anyone inline before you approve. As the team grows, Octo proposes role changes, for example when a partner's editor needs access to one group.

### Change roles and ownership

- An Admin or Owner can change another user's role from the user list, after confirming in a popup. Business Account then emails that user about the change.
- The Owner's three-dot menu offers only **Copy Email**. Every other user's menu offers **Transfer Ownership**, **Copy Email**, and **Remove User**.
- When ownership moves to another user, the **Brand email** in **Brand Profile** changes to the new owner's email.
- The owner always appears first in the user list. The list supports search, sorting by email, and pagination.

### Create a custom role

You can add your own roles next to the default ones. Click **Create New Role** to open the **New Role** drawer.

1. Enter the role name.
2. Enter a description.
3. Select the permissions the role grants. The name, description, and permissions are all required.
4. In the **Assign Role** step, assign users to the role by email.
- Admin and Owner hold every permission. Default roles show their permissions, but you can't change them or delete those roles.
- A role's three-dot menu offers **Manage Role**. Owners and admins also see an option to delete the role.
- In the role editor, **Edit Role** updates the name and description, and **Manage Permissions** updates what the role can do. **Cancel** discards your changes.
- **Role Details** shows a role's permissions read-only. You can also invite users to the role from the editor.
- You can't delete a role while users hold it. Remove them from the role first.
- The roles list supports sorting by name and pagination.

## What it reports

The audit log under **Settings** > **Audit** starts recording when the invitations go out. [Security, data residency, and compliance](https://begenuin.com/developers/get-started/any-business/security-data-residency-and-compliance) explains how it fits with Genuin's other account controls.

- **Change history**: every change, recorded by user and time.
- **Supervised Intelligence actions**: each action Supervised Intelligence took, with the approval or rule that allowed it.

## Connect your systems

Roles run in your Business Account and need no code. [Add moderators to a community](https://begenuin.com/developers/developer-resources/api/assign-moderators-to-community-using-api) gives accounts the moderator role from your own systems. [Update a group and its members](https://begenuin.com/developers/developer-resources/api/add-or-manage-group-members-collaborators-using-api) adds or removes group members and changes group settings. [Generate an access token](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api) exchanges your API key and secret for the token every other call needs. [Environments, credentials, and test data](https://begenuin.com/developers/developer-resources/guides/environments-credentials-and-test-data) explains the separate QA and Production credentials.

The team and role calls in the [Business Account API](https://begenuin.com/developers/get-started/any-business/business-account-api-provisioning-oauth-and-the-resource-map) are proposed, not live. [Live API today and the Business Account API roadmap](https://begenuin.com/developers/developer-resources/guides/live-api-today-and-the-business-account-api-roadmap) maps what you can call now to what's planned.