> ## Documentation Index
> Fetch the complete documentation index at: https://docs.assuric.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and access (authentication and authorisation)

> What someone can do in Assuric, set by their permission level, and how they sign in, seen from their person sheet.

<Note>
  **Quick summary**

  * A person's permission level sets what they can do in Assuric, and everyone has exactly one.
  * Only an Admin can add people or change a person's permission level.
  * An Admin can require multi-factor authentication for a whole permission level, not for a single role.
</Note>

## Permission levels

Authorisation, what someone can do once signed in, is their permission level: everyone has exactly one, set when you add them.

| Level | What it means |
| - | - |
| **Staff portal only** | *Does not have access to your Assuric dashboard, but can still visit your staff portal* |
| **View-only** | *Can view information in your Assuric dashboard, but not make changes* |
| **User** | *Can make edits to information in your Assuric dashboard* |
| **Admin** | *Can configure your workspace and control users and permissions* |

Only an Admin can add people or change someone's level. Some screens use other names:

* The People table's *Permissions* column shows *View-only* as *Viewer*.
* The People table's filter shows *User* as *Editor*.
* The multi-factor authentication setting shows *Staff portal only* as *Staff Portal*.

To [give an auditor access](/quality/auditor-access), use *View-only*. Who can edit a specific document is set in that document's [Permissions](/documents/creating-a-document#permissions).

## The person sheet

Click anyone on the **People** tab to open their sheet.

<Frame caption="A person's sheet. **1** Edit changes their name, title, groups, roles and permission level in one form. **2** Permissions & Access shows their permission level, account status and sign-in methods.">
  <img src="https://mintcdn.com/assuric-docs/DF7jt0hMRipYoIUw/images/people/person-sheet.png?fit=max&auto=format&n=DF7jt0hMRipYoIUw&q=85&s=bf3bfc0a59fce48579e8ab48cb547119" alt="A person sheet showing the Edit button in the header and the Permissions and Access section with Permission level Admin, Account status Added and two Authentication icons" width="788" height="442" data-path="images/people/person-sheet.png" />
</Frame>

**Authentication** shows an icon per sign-in method:

* The envelope is **Email verification**.
* The phone is **Authenticator app enrolled**. It's orange when an authenticator app is required and they haven't set one up yet.

## Change someone's permission level

<Steps>
  <Step title="Open their Permissions & Access">
    Open their sheet, then click the pencil on **Permissions & Access**.
  </Step>

  <Step title="Pick a level and save">
    Choose the new level and click **Update Permissions**.

    <Frame caption="The Change Permissions dialog, with Admin selected. **1** Update Permissions saves the new level.">
      <img src="https://mintcdn.com/assuric-docs/DF7jt0hMRipYoIUw/images/people/change-permissions.png?fit=max&auto=format&n=DF7jt0hMRipYoIUw&q=85&s=91c145ea97a1d68b2b4c1ff658935246" alt="The Change Permissions dialog for paul@assuric.com listing Staff portal only under No workspace access, and View-only, User and Admin under Workspace access, with the Update Permissions button highlighted" width="512" height="654" data-path="images/people/change-permissions.png" />
    </Frame>
  </Step>
</Steps>

## Sign-in and multi-factor authentication

Authentication is how someone proves who they are, and it's passwordless: a link and code sent to their email, or their Google account. Our team can set up single sign-on (SSO) with another identity provider. See [Navigating Assuric](/assuric-overview/navigating-assuric) for the sign-in flow.

Multi-factor authentication adds an authenticator app to sign-in:

* Each person sets up their own from their account menu (their initial, top right): **Authentication** → **Account Security**.
* An Admin can require it per permission level, not per role, from **Settings** → **Authentication** in the sidebar.

<Tip>
  **What we recommend**

  Give each person the lowest level their work needs. Most staff and contractors only need *Staff portal only*.
</Tip>

## Related articles

<Columns cols={2}>
  <Card title="Authentication" icon="key-round" href="/settings/access-and-security">
    The workspace sign-in and multi-factor authentication settings.
  </Card>

  <Card title="Roles and groups" icon="contact-round" href="/people/roles-and-groups">
    What gets assigned to someone, as opposed to what they can do.
  </Card>

  <Card title="Inviting people" icon="user-plus" href="/getting-started/inviting-people">
    Adding someone and setting their level as you invite them.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.