# Roles and access

What a role lets its holders do, and who makes and assigns roles.

In short: A role says what its holders may do. All roles are made in Straza. An application role grants tools on one MCP server, a business role groups application roles, an approver role may decide held calls, and a Straza role carries rights in Straza itself. Your IGA, or an admin on standalone, decides who holds each role.


Aroleisanamedsetofrightsthat[peopleandagents](https://docs.straza.ai/concepts/identities/index.md)hold.Strazadecideseachtoolcallfromthesession'sroles.##WhatarolegrantsonaserverAnapplicationrolereachesone[MCPserver](https://docs.straza.ai/concepts/mcp-apps-and-the-gateway/index.md)throughoneaccessrow.Therownamesthetoolsitsholdersmaycallthere:toolsnamedonebyone,everytooltheserverhastoday,oreverytoolincludingtheonesitaddslater.Atooltherownamesrunsunlessa[policy](https://docs.straza.ai/concepts/policy-model/index.md)deniesthecallorholdsitforaperson.Noallowruleisneeded,sorulesarewrittenonlyforthetoolsthatneedadenyoraperson'sapproval.Onaserverthatdeclaresits[objects](https://docs.straza.ai/concepts/objects/index.md),thesamerowalsosayswhichobjectstherolecovers.Thedemostack'srolepostgres-sales-eureachesseventoolsoftheserverpostgres,suchas`read_rows`,andcoversonlythedatabasesales_eu.Asessionseesatoolonlywhentheserverlistsit,theserver'smanifestexposesit,andoneofthesession'sroleshasanaccessrowthatnamesit.Policythenhidesthetoolsitdenies.Ifnoneofthesession'srolesreachesaserver,acalltooneofthatserver'stoolsgetsthesameunknown-toolanswerasamisspelledtoolname.Anagentcannotlearnwhichtoolsitwasnotgiven.Amissingaccessrowalsolookslikeamissingtool,anditgivesnodenyreason.##ThekindsofroleEachrolehasakind,setwhentheroleismade.|Kind|Whatitsholdersget|Onthedemostack||---|---|---||Application|Thetoolsofoneserver.Onethatreachesnoserveronlypickswhichpolicyapplies|postgres-sales-eu||Business|Everythingtherolesitcomposesgrant,suchasoneapplicationroleperserver|analyst,whichcomposespostgres-sales-eu||Approver|Therighttodecideaheldcallwhenarulenamestherole.Notools|sec-approvers||Straza|RightsinStrazaitself,andnotoolsonanMCPserver|straza-admin,andmcp-admin-postgresfortheserverpostgres|Asessionholdsitsownrolesandeveryroletheycompose.Apersonwhoworkswiththreeserverscanthereforeholdabusinessrole,andpolicynamestheapplicationrolesitcomposes.Anapproverrolecomposesnootherrole,andnorolecomposesit.Thatwaythepeoplewhomaydecideareexactlyitsdirectholders,thelistthat[yourIGA](https://docs.straza.ai/evaluate/identity-and-your-iga/index.md)certifiesoranadminkeepsonstandalone.[Approvals](https://docs.straza.ai/concepts/approvals-model/index.md)explainswhodecideswhenarulenamesnoapproverrole.Therearenoaccessrowsontheagent'sownmachine.Ahooktheredecideseachlocaltoolcall,suchasashellcommand,bypolicyalone.Policysetsselectsessionsbyapplicationrole,sothesession'srolesstillpickwhichrulesapply.Anapplicationrolethatreachesnoserverexistsforthiscase.Ithasnoaccessrowandonlynamesasetofpeopleandagentsforpolicy.##WhererolescomefromRolesaremadeinStraza,andyourIGAcannotcreatethem.Aglobaladmincanmakeanyrole.Aserver'sownadminmakestherolesofthatserver,andeachsuchrolebelongstotheserver.Itsnamestartswiththeserver'snameandahyphen,itreachesonlythatserver,anditlistsitstoolsbyname.Onlyaglobaladminmaygivearoleeverytoolincludingtheonesaserveraddslater.Strazamakessomerolesitself,suchasstraza-global-mcp-adminateachstartwhenitismissing,andanadminroleforeachserveritadds.Everychangetoarole,includingitsaccessrowandtherolesitcomposes,isa[draft](https://docs.straza.ai/concepts/drafts/index.md).Anagentmayproposeone,whichwaitsuntilapersonpublishesit.##WhodecideswhoholdsaroleOnenterprise,yourIGAassignsroles.EachroleappearsthereasaSCIMgroup,andmembershipofthatgroupistheassignment.Thegroupalsocarriesaread-onlyviewofwhattherolegrants:itsserver,itstools,thepoliciesthatnameitandtheobjectsitcovers.Acertifierwhoreviewsabusinessrolethereforeseesthereachoftherolesitcomposesonthebusinessroleitself.OnstandalonethereisnoIGA,andanadminassignsrolesintheconsoleortheCLI.Rolesdonotdependontheidentityproviderthatcheckssign-in.TheyworkthesamewhenpeoplesigninwithEntraID,OktaorKeycloak,becauserolemembershipcomesfromyourIGAoverSCIM,orfromanadminonstandalone.Anewassignmentreachesarunningsessionwhenitnextchecksin,as[Machinesandsessions](https://docs.straza.ai/concepts/machines-and-sessions/index.md)explains.Thegatewaythentellstheagent'sclientthatitstoollistchanged,andtheclientfetchesthelistagainwithoutarestart.Beforeanyagentstarts,anadmincanpreviewwhataroleorapersonwouldsee,withareasonforeachtool.[Accessperrole](https://docs.straza.ai/guides/serve-mcp-apps/catalogs-per-role/index.md)showshowtogivearoleitsaccessandreadthatpreview.Whatanexpertasksaboutroles:Rolenamesthatstartwithstraza-ormcp-admin-arereservedfortheproduct,andnobodycanmakeone.Arole'skindneverchangesafteritismade.Tochangeit,makearoleofthenewkind,moveitsholdersthere,thendeletetheoldone.Anapplicationrolehasatmostoneaccessrow,soitreachesoneserver.Arolemadewithoutaservercannotbegivenaccesstoonelater.Makearoleofthatserverinstead,andcomposebothintoabusinessrole.Arolethatbelongstoaservercomposesnootherrole.Peoplewhoneedtwoserversholdabusinessrolethatcomposesoneroleofeach.Policyselectssessionsbyapplicationroleonly.Thecheckofapolicysetrefusesanyotherkindofrolethere,andforabusinessorapproverroleitsmessagenamesthefix.Arulethatasksapersonnamesapproverrolesorstraza-admin.Deletingaroleendseveryassignmentofitandremovesitsaccessrow.Italsoturnsoffeachlivepolicysetthatmatchedthatrolealone,becausesuchasetwouldmatchnobody.Strazarefusesthedeletewhilealivepolicysetnamestheroleasanapprover.Itneverdeletesarolewhosenamestartswithstraza-,sototakesucharolefromaholder,removetheassignment.Arolecanalsocarrya[knowledgepack](https://docs.straza.ai/guides/govern-an-agent/knowledge-packs/index.md),textthateverysessionoftherolestartswith.Next:[Objects](https://docs.straza.ai/concepts/objects/index.md)