# Roles and permissions

Per-project roles with five levels across fourteen sections, trimming access without ever adding permissions.

Source: https://ardumaker.com/en/docs/roles-y-permisos/

- Category: Projects and companies
- Status: Available
- Requirements: Be the project manager to create and assign roles
- MCP tools (Read only): `listar_miembros_proyecto`, `ver_proyecto`, `ver_contexto_inicial`

## What can you do with it?

| Level | What it allows |
| --- | --- |
| `ninguno` | Does not see the section |
| `ver` | Reads, does not touch |
| `aportar` | Creates, and edits or deletes only its own |
| `editar` | Modifies anyone's content, without deleting |
| `borrar` | Full control of the section |

The configurable sections are: `proyecto`, `etapas`, `tareas`, `comentarios`, `adjuntos`, `calendario`, `grabaciones`, `miembros`, `recursos`, `github`, `logs`, `papelera`, `finanzas` and `finanzas_balance`. Reading and signing policies is not configurable: it is never denied to anyone.

## When should you use it?

- To add a client who comments and uploads files without being able to delete others' work.
- So a collaborator only sees their part of the finances.

## How does it work in ArduMaker?

- Each project starts with 14 roles with full permissions (`Client`, `Manager`, `Developer`, `DevOps`, `QA / Tester` and others). They cannot be deleted but can be edited; the manager creates their own.
- A role **trims** someone's access: it never adds permissions. A member with no assigned role can do everything.
- Inside the project the project role rules, even if the person is a company admin. Only the system admin is above it.
- The manager is whoever has a manager role, created the project, is an admin of an associated company, or is the system admin. The manager administers roles and policies, but their own role still limits them in the sections.
- A new section a role has not written is resolved with its level for future sections.

## What actually changes?

- Changing a member's role changes their permissions and which policies they must sign, and is recorded in the history.
- The project detail omits fields of sections the person cannot see.

## Diagram

**How a permission is decided**

```text
Base access (member, admin or member of an associated company)
  ↓
Project role (trims per section)
  ↓
Pending policy (blocks entry until signed)
  ↓
Effective permission (mis_permisos in the detail)
```

## Expected result

Each person sees in the project detail their effective permissions per section and whether they are a manager, so the interface shows only what they can do.

## Errors and troubleshooting

- An error of type `permiso_de_rol` means the role does not reach that section.
- An error of type `politica_pendiente` means a policy still needs signing.
- `Only the project manager can change a member's role`: only the manager reassigns roles.

> **PRECAUCION:** A hand-made role has, by default, level `ver` for future sections: when enabling a new section, such as finances, review what each role sees.

## MCP access

An MCP agent acts with its owner's permissions, trimmed by the scope it was given. It can read members and permissions, but **never** adds or removes members, changes roles or creates, edits or deletes roles.

- `listar_miembros_proyecto`: members and their role.
- `ver_proyecto`: includes the `permisos` block.
- `ver_contexto_inicial`: the agent's scope and the operations no agent can perform.

See also [MCP permissions](https://ardumaker.com/en/docs/permisos-mcp) and [/mcp/docs](https://ardumaker.com/en/mcp/docs).

## Related features

- [Companies](https://ardumaker.com/en/docs/empresas/)
- [Project templates](https://ardumaker.com/en/docs/plantillas/)
- [Document signing](https://ardumaker.com/en/docs/firma-de-documentos/)
- [Financial management](https://ardumaker.com/en/docs/gestion-economica/)
- [MCP agent permissions](https://ardumaker.com/en/docs/permisos-mcp/)
- [Member management](https://ardumaker.com/en/docs/gestion-de-miembros/)