Default Roles Reference
All roles available in a Liferay DXP installation can be viewed in the Roles administrative application, organized by scope. Navigate there using Control Panel → Users → Roles. Roles that are available out-of-the-box are described below.
Regular Roles
Guest: The Guest Role is assigned to unauthenticated visitors and has the lowest-level permissions.
User: The User Role is assigned to authenticated Users and grants basic permissions (mostly Add to Page permissions for their own Sites).
Power User: The Power User Role grants more permissions than the User Role. It’s an distinguishes regular Users from more privileged Users. For example, you can define it so that only Power Users have personal Sites.
Publications User: The Publications User grants basic permissions for accessing the Publications application and creating individual publications.
Administrator: The administrator Role grants permission to manage the entire installation, including global settings and individual Sites, Organizations, and Users. The Administrator’s permissions are hard-coded and cannot be overridden.
Site Roles
Site Member: The Site Member Role grants basic privileges within a Site, such as permission to visit the Site’s Pages.
Site Administrator: The Site Administrator Role grants permission to manage almost all aspects of a Site including Site content, Site memberships, and Site settings. Site Administrators cannot delete the membership of or remove Roles from other Site Administrators or Site Owners. They also cannot assign other Users as Site Administrators or Site Owners.
The built-in Site Administrator Role intentionally grants a permission that is not normally possible for a Site-scoped Role: Site Administrators can view Users that are not yet part of the Site. This view permission is required to add Users to the Site. A custom Site Role cannot duplicate this ability because of the Regular-scoped permission that’s required: View Users. Therefore, to duplicate the Site Administrator’s permissions within a custom Role, you must create two Roles: the Site Role and a separate Regular Role with permission to view the globally scoped User resource.
Site Owner: The Site Owner Role is the same as the Site Administrator Role except that it grants permission to manage all aspects of a Site, including permission to delete the membership of or remove Roles from Site Administrators or other Site Owners. They can assign other Users as Site Administrators or Site Owners.
Organization Roles
Organization User: The Organization User Role grants basic privileges within an Organization. If the Organization has an attached Site, the Organization User Role implicitly grants the Site member Role within the attached Site.
Organization Administrator: The Organization Administrator Role grants permission to manage almost all aspects of an Organization including the Organization’s Users and the Organization’s Site (if it exists). Organization Administrators cannot delete the membership of or remove Roles from other Organization Administrators or Organization Owners. They also cannot assign other Users as Organization Administrators or Organization Owners.
Organization Owner: The Organization Owner Role is the same as the Organization Administrator Role except that it grants permission to manage all aspects of an Organization, including permission to delete the membership of or remove Roles from Organization Administrators or other Organization Owners. They can assign other Users as Organization Administrators or Organization Owners.
Account Manager: The Account Manager Role is a unique Organization Role that allows any User with the Role and membership in an Organization to administer all accounts associated to the Organization. It grants permission to manage all aspects of the Accounts it has access to, including permission to delete the membership of or remove Roles from Account Administrators. Account Managers can assign other Users as Account Administrators or Account Managers.
Space Roles
Spaces, Design Libraries, Content Marketing Platform Projects, and Asset Libraries share one Role type, shown on the Space Roles tab. A Role’s subtype decides which of them list it. For how subtypes work, see Space Role Subtypes.
Space Member: The Space Member Role grants basic privileges within a Space, such as permission to view Space content. Adding a member to a Space assigns this Role by default.
Space Connected Site Member: The Space Connected Site Member Role is assigned automatically to Users who are members of a Site connected to the Space.
Space Content Reviewer: The Space Content Reviewer Role grants permission to create, edit, and delete the Space’s content and files, and to manage the tags applied to them.
Space Administrator: The Space Administrator Role grants permission to manage almost all aspects of a Space including Space content, Space memberships, and Space settings. Space Administrators can add Users to the Space and remove them from it, including other Space Administrators and Space Owners. They cannot assign or remove Space Roles, however. That is reserved for Space Owners and instance administrators.
Space Owner: The Space Owner Role is the same as the Space Administrator Role except that it also grants permission to assign and remove Space Roles, including the Space Administrator and Space Owner Roles. A Space’s creator receives the Space Owner Role.
Design Library Roles
Design Library Member, Design Library Content Reviewer, Design Library Administrator, and Design Library Owner carry the Design Library subtype. Liferay DXP creates them when the Design Libraries release feature flag (LPD-57283) is enabled. With the Depot Role Scoping release feature flag (LPD-96750) enabled, only Design Libraries list them.
Managing Design Library Members describes what each of these Roles grants.
Project Roles
Project Member, Project Contributor, and Project Manager carry the Project subtype. Content Marketing Platform creates them. It requires the Content Marketing Platform (CMP) release feature flag (LPD-58677) and a CMP license. With the Depot Role Scoping release feature flag (LPD-96750) enabled, only Projects list them.
Project Roles and Permissions, in the Content Marketing Platform documentation, describes each Role and maps its permissions in a matrix.