# Create a User Role

A role is a named set of permissions that decides which parts of the system a user can see and change. When none of the predefined roles line up with what a particular user should be allowed to do, create your own. A custom role lets you hand out exactly the permissions that match someone's job, and you can build one from a blank slate or start from a role that is already close.

:::note
The PBX web portal is the admin site for your phone system (PBX stands for Private Branch Exchange, the on-account phone system that routes your calls). Roles live under **Extension and Trunk > Role**.
:::

:::tip
Grant only the permissions a person actually needs for their job (this is called least privilege). Handing out more access than necessary makes accidental changes and toll-fraud exposure more likely.
:::

## Build a role from scratch

1. Sign in to the PBX web portal and open **Extension and Trunk > Role**.
2. Click **Add**.
3. In the **Role Name** field, type a name that makes the role easy to recognize later.
4. Turn on the permissions this role should have. For a full breakdown of what each permission controls, see [User Role Permissions](/pbx/administrator-guide/user-role-permissions/).
5. Click **Save**.

## Duplicate an existing role

If a current role is almost what you need, copy it. The new role starts with every permission the original has, and you can adjust from there.

:::tip
Copying is usually faster than starting from scratch. Pick the existing role that is closest to what you want, then add or remove a few permissions instead of setting every one by hand.
:::

1. Sign in to the PBX web portal and open **Extension and Trunk > Role**.
2. Create the copy:
   1. Click **Copy Role**.
   2. From the **Choose a role to copy** drop-down, pick the role you want to base the new one on.
   3. In the **Role Name** field, enter a name that identifies the new role.
   4. Click **Save**. The new role now carries the same permissions as the one you copied.
3. Fine-tune the permissions on the new role:
   1. In the **Role** list, click the edit icon ![Edit](/images/pbx/edit.png) next to the role you just created.
   2. Select the permissions you want to add and clear the ones you do not. See [User Role Permissions](/pbx/administrator-guide/user-role-permissions/) for details on each option.
   3. Click **Save**.

:::caution
Editing a role's permissions changes access for every user already assigned to that role, not just new ones. Before you clear a permission on a role that is in use, confirm no one still needs it.
:::

## Next step

Creating a role does not change anyone's access on its own. It takes effect only after you [assign it to a user](/pbx/administrator-guide/assign-a-role-to-a-user/).