> ## Documentation Index
> Fetch the complete documentation index at: https://vytral-dependabot-npm-and-yarn-development-95cc887cce.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Access control and workspace security
> Create least-privilege roles, assign workspace members, apply job scopes, enforce MFA and IP allowlists, and review audit events in Harly.
Harly uses workspace-scoped RBAC. A role combines permissions with an optional
job scope. Role permissions are enforced on the server; hiding a navigation item
does not grant or revoke access by itself.
## Built-in roles
| Role | What it can do |
| ------------------ | --------------------------------------------------------------------------------------------------------------------- |
| **Owner** | Unconditionally has every permission. The Owner role is locked and cannot be edited or deleted. |
| **Admin** | Starts with every explicit permission, but an administrator can tune it. It is not the same as the locked Owner role. |
| **Recruiter** | Create and publish jobs, manage candidates, offers, interviews, documents, and recruiting workflows. |
| **Hiring manager** | Approve and edit jobs, view candidates, move applications, provide interview feedback, and read reports. |
## Create a custom role
Only members with the `roles:manage` permission can create or edit roles. The
role editor is in **Settings → Members & roles → Roles → New role**. The
`/settings/roles` path redirects to this page.
Enter a name between 2 and 40 characters, such as `Sourcer`. Harly creates
a slug-like role key from the name. A role key that collides with a
built-in key (`owner`, `admin`, `recruiter`, or `hiring_manager`) is
rejected.
Choose **All matching jobs** or **Assigned jobs only**. You can also enter
comma-separated department and region values, for example:
```text theme={null}
Departments: Engineering, Product
Regions: LATAM, EMEA
```
Empty department and region fields mean no filter for that dimension.
Select permissions from the Jobs, Candidates, Privacy, Collaboration,
Documents, Analytics, and Administration groups. Save the role when the
permission set and scope are complete.
Harly applies a privilege ceiling: you cannot grant a role a permission you do
not hold, or give it a broader job scope than your own. This prevents a scoped
administrator from creating an escalation path.
## Assign a role
Open **Settings → Members & roles → Members**. Select a role in a member's
**Role** dropdown, repeat any other changes, and choose **Save changes**. New
invitations and direct member creation also include a **Role** selector; the
Owner role is never available for invitations.
Deleting a custom role moves its members to **Recruiter** inside the same
transaction. Built-in roles cannot be deleted. Editing a built-in role stores a
workspace-specific override; its display name stays fixed, and the Owner role
remains locked.
Review role creation, updates, and deletion in the audit log after every
organizational change. Deleting a custom role reassigns its members to
Recruiter.
## Permissions
Permissions follow the pattern `resource:action`. The available permissions are:
| Permission | What it controls |
| --------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
| `jobs:create` `jobs:view` `jobs:edit` `jobs:delete` `jobs:publish` `jobs:approve` | Job lifecycle |
| `candidates:view` `candidates:edit` `candidates:delete` `candidates:move` | Candidate records |
| `hiring_team:manage` | Add or remove hiring team members for a job |
| `collab:write` | Notes, scorecards, interview scheduling, and candidate messaging |
| `interviews:manage` `interviews:feedback` | Schedule interviews and submit feedback |
| `tasks:read` `tasks:write` | Task management |
| `offers:manage` `offers:approve` | Draft, send, approve, and withdraw offers |
| `templates:manage` | Email and offer templates |
| `reports:read` | Pipeline and analytics reports |
| `members:read` `members:invite` `members:edit` `members:remove` | Team management |
| `invite_links:manage` | Invite-link lifecycle |
| `settings:edit` | Workspace settings |
| `integrations:manage` | Integration credentials and connections |
| `roles:manage` | Role and permission management |
| `security:manage` | MFA enforcement, SSO, and security settings |
| `documents:read` `documents:manage` `documents:share` | Candidate documents |
| `automations:manage` | Workflow automation rules |
| `dsar:manage` | Data subject access requests |
## Job scopes
Layer scopes on top of a role's permissions to restrict job-scoped resources:
* **All matching jobs**: access every job that matches the department and region filters.
* **Assigned jobs only**: access only jobs where the member is on the hiring team.
* **Departments**: allow only matching job departments.
* **Regions**: allow only matching job regions.
Use **Assigned jobs only** for recruiters who should work only on their
requisitions. Add department or region constraints for geographic or functional
divisions. A job with no department or region does not match a non-empty filter.
## MFA and session controls
Owners can enforce MFA from **Settings → Security**. When MFA is enforced,
members without a configured factor are blocked from the workspace until they
enroll.
Additional controls available in **Settings → Security** include passkeys,
trusted email domains, IP allowlists, suspicious-session detection, and
reauthentication windows for sensitive changes.
Self-hosted deployments behind an external reverse proxy must set
`TRUSTED_PROXY_IPS` for IP allowlists (and per-IP rate limits) to evaluate
the original client address instead of the proxy's address. See
[proxy modes](/self-hosting/proxy-modes#trust-your-reverse-proxy-for-client-ips).
## Audit review
Review security and administrative events periodically and after any incident.
Export the audit log before deleting or anonymizing records that may be needed
for an active investigation.
A candidate's deletion request is not a security incident. Handle it through
the [privacy workflow](/security/privacy), not the audit log.