# Users & Roles

CoderFlow includes role-based access control with four predefined roles. Administrators manage users through the Web UI.

## Roles

### Administrator

Full system access. Administrators can:
- Manage all users, roles, and permissions
- Configure environments and system settings
- Access all tasks across the organization
- View audit logs and server health

### Manager

Team oversight and task management. Managers can:
- Create and manage users (up to Manager level)
- View and manage all tasks
- Judge, approve, or reject tasks
- Assign tasks to other users

### Developer

Standard permissions for development work. Developers can:
- Create and execute tasks
- View and manage their own tasks
- Access environments for development
- Manage their own API keys

### Viewer

Read-only access for monitoring. Viewers can:
- View their own tasks (read-only)
- View environment details
- Manage their own API keys

## Role Hierarchy

Users can only manage others at or below their privilege level:
- Administrators can manage anyone
- Managers can manage Developers and Viewers
- Developers and Viewers cannot manage other users

## Custom Permissions

Beyond role-based permissions, administrators can assign additional permissions to individual users. This allows fine-tuned access control—for example, granting a Developer the ability to judge tasks without promoting them to Manager.

## Managing Users

User management is done through the Web UI:
- Create new users with username, email, and role
- Edit user details and change roles
- Assign custom permissions as needed
- Deactivate or remove users

For initial setup or automation, users can also be created via command-line scripts or the REST API.
