Every Peerlify network has a fixed set of seven roles. The point is delegation: the person who approves new laptops shouldn't need the power to rewrite access policy, and the person who pays the invoice shouldn't need either.
What each role can do
| Role | What it can do | Plans |
|---|---|---|
| Owner | Everything, including deleting the network and transferring ownership. One per network. | All |
| Admin | Everything except deleting the network and transferring ownership. Billing included. | All |
| Network Admin | Edits access rules, network settings and tag definitions. Can't manage members or devices. | Business, Enterprise |
| IT Admin | Manages devices and members (can invite Members) and applies tags to devices. Can't edit access rules or create tags. | Business, Enterprise |
| Billing Admin | Manages billing and can view the member list. Nothing else. | Business, Enterprise |
| Auditor | Read-only: the member list and the logs, including the audit log. | Business, Enterprise |
| Member | Uses the network from their own devices. No console access. | All |
On the Personal, Personal+ and Team plans you have Owner, Admin and Member. The four specialised roles come with Business and Enterprise.
Enforced on the server
Every permission check goes through one server-side map from role to permission. The console mirrors the same map to hide controls a role can't use, so an IT Admin never sees an "Edit rules" button only to be told no. If the UI and the server ever disagree, the server wins: the UI only hides things, it doesn't enforce them.
Roles control the console. What a person can reach over the network is a separate question, answered by the network's access rules, which can name roles directly (for example role:auditor) alongside users, groups and tags. See Members and roles and the access control model.
Assigning roles
Owners and Admins change roles from the Members page in the console, or through the API. Role changes made in the console are recorded in the audit log.
If you're new to Peerlify, start with what a mesh VPN is and how Peerlify works, then come back here when you're ready to bring a team in.