# Roles & Permissions

> Understand how roles control access and actions in NOVA Cloud. NOVA Cloud uses role-based access control to define what users can see and do in the system. Each role is designed around typical responsibilities in automation projects from system administration to day-to-day operation.

NOVA defines three main roles:

- **Admin**s manage the system and its lifecycle.
  They primarily work through the NOVA user interface.
- **Developer**s configure and build automation solutions.
  They work across both the provided UIs and API tooling.
- **Operator**s run and monitor production.
  They work through the NOVA user interface.

| Capability | Admin | Developer | Operator |
| - | - | - | - |
| System configuration (update, restore, license) | Yes | No | No |
| Cell setup and engineering | Yes | Yes | No |
| API usage | Yes | Yes | No |
| Runtime operation and monitoring | Yes | Yes | Yes |
| Backup operations | Yes | Yes | Yes |

### Hierarchy

| Role | Description | Includes permissions of |
| - | - | - |
| Admin | Full access to all resources | Developer, Operator |
| Developer | Can create and manage virtual resources | Operator |
| Operator | Read-only access to resources | — |

## Admin

Admins have full control over the system, including configuration, maintenance, and governance.
They can:

- Configure system-wide settings
- Manage licenses and cloud connections
- Create and manage cells and their resources
- Perform system updates and restores
- Run backups

They can additionally perform all actions available to Developers and Operators.

## Developer

Developers configure and build the automation environment.

| Can | Can't |
| - | - |
| Create and configure cells | Update or restore the system |
| Install and manage apps | Change license settings |
| Configure controllers and bus I/O | Configure cloud connections |
| Manage programs and collision data | |
| Operate robots and virtual controllers | |
| Run backups | |

## Operator

Operators focus on running production safely and efficiently.

| Can | Can't |
| - | - |
| View system and license status | Install or remove apps |
| Execute and monitor programs | Change engineering configurations (for example controllers or I/O setup) |
| Operate controllers and I/O during runtime | Modify collision models |
| Run backups | Perform system updates or restores |
| Access production data | |

## How access is controlled

Access in NOVA is determined by two factors:

- **Role assignment**, either Admin, Developer, or Operator
- **Resource scope**, either system-wide or cell-specific

For example:

- System-level actions, like updates or license changes, require Admin permissions.
- Cell-level actions depend on both the role and whether the user is assigned to that cell.

Learn more about [how scopes control access and actions](/nova-cloud/scopes).

## Access layers

Access in NOVA is defined by four layers:

- **License** → who can use the system
- **Role** → what a user can do
- **Cell access** → where a user can act
- **Apps** → how users interact with the system

### Cells and membership

Cell resources are scoped individually.

- **Admins** have full access across all cells.
- **Developers and Operators** must be assigned to a cell to access it.

If a user cannot access a specific cell:

- Admins need to check whether they are assigned to that cell.

---

## Example workflow: From license to production

Learn how to set up licenses, assign roles,
and start working with NOVA in our [Licensing & Roles guide](/nova-cloud/guides/licensing-and-roles).