> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles and data scopes

> Control which cost data each role can see, in addition to which features it can use.

## Overview

Every user in nOps holds one or more **roles**, and each role carries two kinds of access:

* **Permissions** — which features a role can use (for example, viewing budgets or managing integrations).
* **Data scope** — which *rows* of cost data a role can see (for example, only certain AWS accounts, a specific department, or a subset of your Cost Allocation values).

Permissions and data scope are configured together when you create or edit a role, but they answer different questions. Permissions decide whether someone can open a page or take an action. Data scope decides what they see once they're there — the same Explorer report, filtered differently for different people.

<Note>
  Data scope is optional. Most organizations don't need it — every role is **Unrestricted** by default, meaning it sees the same cost data as anyone else in the organization. Add a scope only when you need to limit what a specific role can see.
</Note>

## Get started

<Steps>
  <Step title="Open Organization Roles">
    Go to **Settings → Users**. Scroll down to the **Organization Roles** section, below Organization Users.
  </Step>

  <Step title="Create or edit a role">
    Click **Add role** to create a new one, or click an existing role to edit it. This opens a dialog with three tabs: **Details**, **Permissions**, and **Data scope**.
  </Step>

  <Step title="Set the access mode">
    On the **Data scope** tab, choose:

    * **Unrestricted** — the role sees all cost data your organization has access to. This is the default.
    * **Restricted** — the role only sees rows matching the rules you define below.
  </Step>

  <Step title="Add scope rules (Restricted only)">
    Click **Add rule** and configure it — see [Building a scope rule](#building-a-scope-rule) below. You can add multiple rules to a single role.
  </Step>

  <Step title="Preview and save">
    Use **Run preview** to see the impact before saving, then save the role.
  </Step>
</Steps>

<Warning>
  A **Restricted** role with no rules denies all cost data — it's a hard deny, not "everything." Add at least one rule, or switch back to Unrestricted.
</Warning>

## Building a scope rule

Each rule narrows a role's data down to specific values on one dimension:

* **Dimension** — any Explorer dimension (account, region, tag, and more), or **Cost Allocation**, which lets you scope to a specific showback's allocation values.
* **Operator** — **Include** (the role sees only rows matching these values) or **Exclude** (the role sees everything except rows matching these values).
* **Values** — the specific accounts, tags, or other values to include or exclude.
* **Include rows with no value** — when checked, rows where this dimension is empty or unallocated are still visible. Leave this unchecked (the default) if unallocated spend shouldn't be visible to a scoped role.

You can add several rules to the same role. Within one role, rules narrow together — a role scoped to `Account = A` **and** `Environment = prod` only sees rows matching both.

## How multiple roles combine

If a user holds more than one role, their access is the **union** of every role's scope — adding a role only ever widens what someone can see, never narrows it. If any one of a user's roles is Unrestricted, that role wins and the user sees everything, regardless of any other role's restrictions.

## Previewing impact

Before saving a restricted role, use **Run preview** on the Data scope tab to see:

* **Scoped total** — spend visible to the role over the last 30 days, under your current rules.
* **Unrestricted total** — the same window with no restrictions, for comparison.
* **Matching rows** — how many rows of cost data the rules currently match.

Check **Preview as unrestricted role** to see what the total would look like if this role had no restrictions — useful for sanity-checking how much a rule set is actually narrowing.

## The roles table

The Organization Roles table lists every role available to your organization, including built-in environment roles and any custom roles you've created, with columns for:

* **Name** and **Slug**
* **Data scope** — a short summary such as "Unrestricted" or a description of the active rules
* **Type** — built-in or custom
* **Description**

<Note>
  If a role's data scope no longer matches a role that exists in your identity system (for example, if the role was deleted there directly), you'll see a banner noting how many scopes are affected. Those scopes are ignored when resolving access — recreate the role to restore it, or leave it to be cleaned up.
</Note>

## FAQs

<AccordionGroup>
  <Accordion title="Who can manage roles and data scopes?">
    Only organization admins with access to role management can create or edit roles and their data scopes, from Settings → Users.
  </Accordion>

  <Accordion title="What happens if I don't set a data scope?">
    Nothing changes — the role stays **Unrestricted** and behaves exactly as roles always have, with access controlled purely by permissions.
  </Accordion>

  <Accordion title="Can I scope access to Cost Allocation values?">
    Yes. Choose **Cost Allocation** as the dimension, then select the specific showback whose allocation values you want to include or exclude.
  </Accordion>

  <Accordion title="Does a data scope affect totals and charts, or just individual rows?">
    Both. Totals, percentages, and chart values are recalculated under the role's scope — a scoped user's dashboard reflects only the spend they're allowed to see, not the organization's full total.
  </Accordion>

  <Accordion title="What if my organization assigns roles from directory groups (SSO/SCIM)?">
    If your identity provider manages role assignment, per-user role changes made directly in nOps can be overwritten on the next sync. Manage role assignment through your directory's group mapping instead.
  </Accordion>
</AccordionGroup>

## Related

* [Users](/platform/users) — invite team members and manage their roles
* [Organizations](/platform/organizations) — organization-level settings and switching
* [Explorer](/inform/explorer) — the dimensions available for scope rules are the same ones you filter by in Explorer