> ## Documentation Index > Fetch the complete documentation index at: https://runpod-b18f5ded-promptless-docs-481-roles-and-permissions.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions > Understand Runpod's built-in team roles and use them to control what team members can do with Pods, Serverless endpoints, network volumes, and billing. Runpod team accounts use built-in roles to control what each member can access and do. Assigning roles lets an admin delegate work without granting full account control. This page is for admins who manage a team account. To create or convert a team and invite members, see [Manage accounts](/accounts-billing/manage-accounts). If you received an invitation and want to join, see [Join a team](/accounts-billing/manage-accounts#join-a-team). ## Why use roles Roles let you apply least privilege by granting each member the minimum role they need for their work. Use the Billing role to separate billing access from technical operations, so finance staff can manage payment methods and invoices without touching compute resources. Use the Dev role to let developers create and manage compute without exposing billing or account settings. Reserve the Admin role for trusted leads who need full control over members, settings, billing, and all compute. ## Available roles ### Basic role The Basic role provides essential access for users who need to work with existing resources without management capabilities. It allows users to access the team account and connect to already-deployed resources such as [Pods](/pods/overview), [Serverless endpoints](/serverless/overview), and [Instant Clusters](/instant-clusters). Users with this role cannot view billing information, start or stop Pods, or create new resources. ### Billing role The Billing role focuses exclusively on financial management. Users with this role can access billing information, manage payment methods, and view invoices, but they cannot access compute resources. This makes the role ideal for finance staff who need billing access without operational permissions. ### Dev role The Dev role extends the Basic permissions with additional capabilities for active development work. It includes all Basic permissions plus the ability to create, start, and stop Pods and manage [network volumes](/storage/network-volumes). Instant Cluster management (creating, deleting, starting, and stopping Instant Clusters) is reserved for the Admin role. Users with this role remain restricted from billing information and account settings. ### Admin role The Admin role provides full control over the account. Administrators can manage team members, configure account settings, handle billing, and control all compute resources. Reserve this role for trusted leads who need full account access. ## Permissions matrix The following matrix shows which permissions each role grants: | Permission | Basic | Billing | Dev | Admin | | ----------------------------------------- | ----- | ------- | --- | ----- | | Access team account | ✅ | ✅ | ✅ | ✅ | | Connect to existing Pods | ✅ | ❌ | ✅ | ✅ | | Create/delete/start/stop Pods | ❌ | ❌ | ✅ | ✅ | | Create/delete Serverless endpoints | ❌ | ❌ | ✅ | ✅ | | Send requests to Serverless endpoints | ✅ | ❌ | ✅ | ✅ | | Connect to existing Instant Clusters | ✅ | ❌ | ✅ | ✅ | | Create/delete/start/stop Instant Clusters | ❌ | ❌ | ❌ | ✅ | | Create/update/delete network volumes | ❌ | ❌ | ✅ | ✅ | | View billing information | ❌ | ✅ | ❌ | ✅ | | Manage payment methods | ❌ | ✅ | ❌ | ✅ | | Invite team members | ❌ | ❌ | ❌ | ✅ | | Manage team permissions | ❌ | ❌ | ❌ | ✅ | | Modify team account settings | ❌ | ❌ | ❌ | ✅ | | Access audit logs | ❌ | ❌ | ❌ | ✅ | If your assigned role does not grant access you need, contact your team's Admin to request a different role. ## Assign a role to a team member You assign a role when you invite a member to your team. The role you choose at invite time determines the member's permissions. Navigate to the [Team page](https://www.console.runpod.io/team) in the Runpod console. In the **Members** section, select **Invite New Member**. Choose the appropriate role for the new member. This role determines what the member can access and do. Enter the email address of the person you want to invite and select **Create Invite**. Copy the generated invitation link from the **Pending Invites** section and share it with the person you want to invite. Invitation links remain active until used or manually revoked. ## Remove access You can revoke a pending invitation from the **Pending Invites** section before it is used. As part of general offboarding, review team membership regularly and revoke access that is no longer needed. To dissolve an entire team and revert to a personal account, see [Manage accounts](/accounts-billing/manage-accounts#convert-to-a-team-account). ## Best practices Assign roles based on each member's responsibilities, and apply the principle of least privilege by granting the minimum role necessary for each person's work. Isolate billing access from technical operations by using the Billing role for finance staff. Review team membership regularly and remove access for members who no longer need it. Review audit logs periodically to ensure compliance with your organization's policies and to identify unusual activity early. ## Next steps Create or convert a team and invite members. Set up billing and payment methods. Review audit logs to track actions across your team. Attribute team spend by project or team.