# Users & Roles

CoderFlow includes role-based access control with four predefined roles. Administrators manage users through the Web UI.

## Roles

### Administrator

Full system access. Administrators can:
- Manage all users, roles, and permissions
- Configure environments and system settings
- Access all tasks across the organization
- View audit logs and server health

### Manager

Team oversight and task management. Managers can:
- Create and manage users (up to Manager level)
- View and manage all tasks
- Judge, approve, or reject tasks
- Assign tasks to other users

### Developer

Standard permissions for development work. Developers can:
- Create and execute tasks
- View and manage their own tasks
- Access environments for development
- Manage their own API keys

### Viewer

Read-only access for monitoring. Viewers can:
- View their own tasks (read-only)
- View environment details
- Manage their own API keys

## Role Hierarchy

Users can only manage others at or below their privilege level:
- Administrators can manage anyone
- Managers can manage Developers and Viewers
- Developers and Viewers cannot manage other users

## Custom Permissions

Beyond role-based permissions, administrators can assign additional permissions to individual users. This allows fine-tuned access control—for example, granting a Developer the ability to judge tasks without promoting them to Manager.

## Managing Users

User management is done through the Web UI:
- Create new users with username, email, and password
- Edit user details (pencil icon) and manage Server Admin status
- Manage access bindings (shield icon) to assign environment-specific roles
- Reset passwords via setup links
- Delete users (trash icon)

The user table Actions column provides icon buttons for Edit, Access Bindings, and Delete, plus a text button for Reset Password.

### Access Bindings

Access bindings connect users to environments with specific roles. Each binding grants the user the role's permissions on that environment. Bindings can be managed:
- Directly per user via the Access Bindings button (shield icon) on the users page
- Via team membership on the Teams page
- Via the Access tab on the Environments page

For initial setup or automation, users can also be created via command-line scripts or the REST API.
