> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and Permissions

> Understand the four Matproof roles and how to invite team members and external auditors.

## Overview

Matproof uses four roles to control what team members can see and do. Roles are assigned per user when they are invited and can be changed later by an Admin or Owner.

## Role comparison

| Permission                               | Owner | Admin | User | Auditor |
| ---------------------------------------- | :---: | :---: | :--: | :-----: |
| View controls, evidence, policies, risks |  Yes  |  Yes  |  Yes |   Yes   |
| Edit controls, evidence, policies, risks |  Yes  |  Yes  |  Yes |    No   |
| Manage vendors                           |  Yes  |  Yes  |  Yes |    No   |
| View integrations                        |  Yes  |  Yes  |  No  |    No   |
| Manage integrations                      |  Yes  |  Yes  |  No  |    No   |
| Invite / remove users                    |  Yes  |  Yes  |  No  |    No   |
| View and edit settings                   |  Yes  |  Yes  |  No  |    No   |
| Manage billing                           |  Yes  |   No  |  No  |    No   |
| Delete organization                      |  Yes  |   No  |  No  |    No   |

## Role descriptions

### Owner

Full access to everything including billing and the ability to delete the organization. There is exactly one Owner per organization. Ownership can be transferred to another user in **Settings → Team**.

Use this role for the founder or the accountable executive sponsor of the compliance program.

### Admin

Full access to all compliance features and team management. Admins can invite and remove users, manage integrations, and configure settings. They cannot touch billing or delete the organization.

Use this role for the compliance manager or IT security lead who runs the day-to-day compliance program.

### User

Can view and edit all compliance content — controls, evidence, policies, risk register, and vendors. Cannot manage users, view integrations, or change settings.

<Note>
  User is the right role for most team members — engineers, department leads, and anyone who contributes to the compliance program without needing administrative access.
</Note>

### Auditor

Read-only access to controls, evidence, and policies. Auditors have a dedicated view optimized for audit work and are redirected to the auditor dashboard on login. They cannot see settings, integrations, or the People module.

Use this role for external auditors and certification bodies during an audit engagement.

<Tip>
  Always invite external auditors as Auditors, not Users. The Auditor role keeps them out of internal settings and gives them a cleaner view focused on what they need.
</Tip>

## Inviting team members

1. Go to **Settings → Team**
2. Click **Invite member**
3. Enter their email address
4. Select a role
5. Click **Send invite**

The invitee receives an email with a link to create their account. If they already have a Matproof account on another workspace, they can accept the invite with their existing login.

### Changing a role

1. Go to **Settings → Team**
2. Find the team member
3. Click the role dropdown next to their name
4. Select the new role

Role changes take effect immediately.

### Removing a user

1. Go to **Settings → Team**
2. Click the three-dot menu next to the user
3. Select **Remove from workspace**

Removing a user revokes their access immediately. Their past contributions (evidence uploads, control edits) are preserved.

## Inviting external auditors

External auditors need access to review your compliance posture. The Auditor role gives them what they need without exposing internal settings.

<CardGroup cols={2}>
  <Card title="Auditor portal" icon="magnifying-glass">
    Auditors land on a dedicated dashboard showing controls, evidence status, policy documents, and risk register — organized for efficient audit review.
  </Card>

  <Card title="Read-only guarantee" icon="lock">
    Auditors cannot modify any records. They can download evidence files and export reports, but cannot create, edit, or delete anything.
  </Card>
</CardGroup>

**Recommended audit workflow:**

1. Invite your external auditor via **Settings → Team** with the Auditor role
2. Share the link to your workspace
3. The auditor accesses the auditor dashboard and reviews evidence at their own pace
4. Remove the auditor's access after the audit is complete

<Warning>
  Remember to remove external auditor access after the engagement ends. Leaving auditor accounts active is both a security risk and a potential finding in subsequent audits.
</Warning>

## Feature flags

Some advanced features are controlled by feature flags at the organization level. These are not self-serve — contact Matproof support to enable them.

| Feature flag              | What it enables                                                     |
| ------------------------- | ------------------------------------------------------------------- |
| `ai-vendor-questionnaire` | AI-assisted vendor questionnaire filling and response analysis      |
| `advancedModeEnabled`     | Advanced mode with additional configuration options for power users |

If a feature you expect to see is missing from your workspace, it may be behind a feature flag. Reach out to support with your organization name to check.