# Overview

Within VM Essentials is a wide array of role-based access control capabilities. These roles can be managed within the Administration > Roles section of the VM Essentials UI as well as through the API or CLI. Entire sections within the appliance UI can be hidden based on the specified access levels for features within VM Essentials. Features have different access scopes that can be selected from and can range depending on the specific feature. The most common scope set involves none, read, and full.

There are several handy tricks for creating new roles within VM Essentials and users can be assigned more than one role. When a user is assigned more than one role, permissions are granted by the role with the highest level of scope access. This allows roles to be built with small subsets of features and combined to grant different individuals relevant permission control. With resource permissions (that is, all types of permissions other than Feature permissions), a default access can be given as opposed to a specific (Full or None) permission for any resource. A specific permission will always supersede a default permission regardless of whether it’s more permissive or more restrictive. In other cases (default vs default OR specific vs specific) the more permissive access will be given.

It’s also important to note that built-in Roles, such as the System Admin “Superuser” Role carry no special prominence. For resource permissions, the System Admin user has defaults set to Full in each section. Thus, pairing the System Admin Role with another Role that may include specific line item permissions for various resource categories may cause your System Admin users to take on a reduced permission set.

NOTE

Feature access control not only applies to the VM Essentials UI but also applies to the public developer API. It is sometimes necessary to logout and back in for changes to a users feature access level to be respected.

**Subtopics**  

- **[Role Creation](https://support.hpe.com/hpesc/public/api/document/sd00007620en_us/render?page=GUID-B8673710-26A0-45E1-AD2D-0937F4C81DDF.html)**
