---
title: Roles and access
description: Three roles, three rights, and per-section rules on top. Enforced on every request, for people and API keys alike.
section: Concepts
order: 4
---

## Roles

| Role | In short |
| --- | --- |
| Originator | Starts cases, uploads, runs and files. |
| Underwriter | The same rights; decisions are recorded under this role. |
| Manager | The same, plus the organization itself: people, API keys and webhooks. |

Every role holds the three platform rights: **view**, **upload** and **edit**. The server checks the right on each request. A capability the screen does not offer you is one the server also refuses.

The current table is shown under **Settings** in the app.

## Section rules

On top of the platform rights, each section of an [expected document list](/docs/concepts/expected-document-lists) says per role who sees it and who may add to it. An upload into a section your role may not add to is refused with a 403 that names the section.

## Organizations

Everything belongs to exactly one organization. A request for something in another organization answers **404**, never 403: from outside, it does not exist.

## API keys

A key acts as an **Originator** of its organization. It cannot reach people, keys, webhooks or passwords. See [authentication](/docs/api/authentication).