# Role Management

The WatchDog MSP Portal uses **role-based access control (RBAC)** to determine what users can see and do across MSP nodes and managed companies. 

:::info Who This Is For
**MSP Owners** and/or **Administrators** responsible for onboarding and MSP Portal Management
:::

Understanding this model is critical before onboarding customers or granting your team access.


# Roles in the MSP Portal
Access within the MSP Portal is controlled using role-based access control (RBAC). Permissions determine both visibility and action capability.
<AccordionGroup>
  <Accordion title="MSP Owner" defaultOpen>
      Assigned to the primary contact when the MSP tenant is created. Provides unrestricted administrative access across the MSP Portal, including billing management and node administration. This role is permanent and cannot currently be edited, transferred, or removed.
  </Accordion>
  <Accordion title="System Generated Parent Role">
      Automatically created with every MSP tenant, this built-in parent-level role cannot be deleted. It provides full administrative access across the Parent MSP node, equivalent to the MSP Owner role, except it does not include Billing Administrator permissions.
  </Accordion>
  <Accordion title="System Generated Child Role(s)">
      Automatically created for each Child MSP node, this built-in role cannot be deleted. It provides administrative control within the specific Child node, aligned closely with MSP Owner permissions, but excludes node management, billing administration, and cascade permissions.
  </Accordion>
  <Accordion title="Custom Roles">
      MSP environments can create custom roles to tailor access based on operational responsibilities.
          - **Parent node custom roles:** Can be assigned any available MSP permissions and intended for organization-wide administrative or operational access
          - **Child node custom roles:** Apply only within the specific Child MSP node. Cannot include node management, billing administration, or cascade permissions
  </Accordion>
</AccordionGroup>


# MSP Portal Permissions
<AccordionGroup>
    <Accordion title="Node Management" defaultOpen>
    **Permission**| **Description**| **Is Cascadable**  
    ---|---|---  
    Create Nodes| Users with this permission can create a Child Node| ❌ No  
    Modify Nodes| Users with this permission can modify the details of a Child Node| ❌ No  
    Delete Nodes| Users with this permission can delete Child Nodes.| ❌ No  
    </Accordion>
    <Accordion title="User Management">
    **Permission**| **Description**| **Is Cascadable**  
    ---|---|---  
    Add Users| Users with this permission can add users| ✅ Yes  
    Modify Users| Users with this permission can modify users| ✅ Yes  
    Delete Users| Users with this permission can deleteusers| ✅ Yes  
    </Accordion>
    <Accordion title="Role Management">
    **Permission**| **Description**| **Is Cascadable**  
    ---|---|---  
    Add Roles| Users with this permission can add roles| ✅ Yes  
    Modify Roles| Users with this permission can modify roles| ✅ Yes  
    Delete Roles| Users with this permission can deleteroles| ✅ Yes  
    </Accordion>
    <Accordion title="Service Account Management">
    **Permission**| **Description**| **Is Cascadable**  
    ---|---|---  
    Add Service Account| Users with this permission can create service accounts| ✅ Yes  
    Modify Service Account| Users with this permission can modify service accounts| ✅ Yes  
    Rotate Service Account Secret| Users with this permission can rotate service account secret keys| ✅ Yes  
    Delete Service Account| Users with this permission can delete service accounts| ✅ Yes  
    </Accordion>
    <Accordion title="Managed Company Management">
    **Permission**| **Description**| **Is Cascadable**  
    ---|---|---  
    Create Managed Company| Users with this permission can create managed companies| ✅ Yes  
    Modify Managed Company| Users with this permission can modify managed companies| ✅ Yes  
    Access Managed Company| Users with this permission can delete managed companies| ✅ Yes  
    Access Managed Company (Read-Only)| Users with this permission can access **Managed Companies**|  ✅ Yes  
    Delete Managed Company| Users with this permission can access **Managed Companies** **(read-only)**|  ✅ Yes  
    </Accordion>
    <Accordion title="Additional Permissions">
    **Permission**| **Description**| **Is Cascadable**  
    ---|---|---  
    Billing Administrator| Users with this permission can manage billing| ❌ No  
    Cascade Node Permissions| Cascade permissions allow roles created at the Parent MSP Node to apply to all child MSP nodes| ❌ No  
    </Accordion>
</AccordionGroup>

# Understanding Cascade Node Permissions

Cascade Node Permissions allow a role created at the **Parent MSP node** to apply automatically to all existing and future Child MSP nodes.

When cascade permissions are enabled:
  * The user gains access to child nodes without manual assignment
  * Permissions are evaluated consistently across the hierarchy

:::info[]
Cascade permissions are **not available** to roles created at the Child MSP node level.
:::

# Best Practices

  1. Use **custom roles** instead of assigning system roles broadly

  2. Limit the use of **cascade permissions** to trusted administrative users

  3. Avoid granting Billing Administrator permissions unless required

  4. Review roles periodically to ensure least-privilege access