> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clausum.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles & permissions

> Who can invite users, change rules, and integrate the API in your organization.

Clausum uses **organization roles** for day-to-day dashboard work. Permissions are enforced in the UI and APIs — if a button is hidden, the action is also blocked server-side.

## Merchant / institution roles

| Role        | Cases & monitor | Protection & rules      | API keys        | Invite team |
| ----------- | --------------- | ----------------------- | --------------- | ----------- |
| **Admin**   | Full            | Full                    | Create / revoke | Yes         |
| **Analyst** | Full            | Edit (policy-dependent) | View            | Usually no  |
| **Viewer**  | Read-only       | Read-only               | No              | No          |

<Tip>
  Exact labels in the UI may appear in Spanish (**Administrador**, **Analista**, **Visor**) depending on your language setting.
</Tip>

### Viewer (read-only)

Viewers can:

* Open **Panel**, **Monitor**, and case lists assigned to the org
* Export or review activity for audits

Viewers cannot:

* Invite users or change team membership
* Create API keys or edit protection rules
* Mutate cases (status changes return forbidden)

## API key permissions (technical)

Separate from human roles, each key carries **scopes**:

| Key type           | Prefix     | Typical scopes                      |
| ------------------ | ---------- | ----------------------------------- |
| Checkout (browser) | `clm_pub_` | `assess`                            |
| Server (backend)   | `clm_sk_`  | assess, fraud report, merchant APIs |
| Event ingest       | `clm_wh_`  | webhook ingest only                 |

Server keys should live only on backends. Never embed `clm_sk_` in mobile or browser code.

## Enterprise operators (Clausum-managed)

Organizations serviced by Clausum operations may also use internal operator profiles to manage **multiple merchants**. Those capabilities are **not self-serve** in public documentation:

* Client provisioning and cross-tenant administration are assigned by Clausum support
* If you need multi-merchant oversight, contact your account team

Merchant administrators only manage **their own** organization in **Equipo** and **Integraciones**.

## Separation of duties

Recommended practices:

* **Payments engineering** holds server keys
* **Fraud / risk** owns blocklists and rules
* **Compliance** owns expedientes submission
* **Read-only viewers** for audit and finance review

<CardGroup cols={2}>
  <Card title="Team & invitations" icon="users" href="/guides/team-and-access">
    Invite flow step-by-step.
  </Card>

  <Card title="Authentication" icon="lock" href="/concepts/authentication">
    Keys vs dashboard session.
  </Card>
</CardGroup>