Create a role for a team
Build a role with exactly the permissions a team needs, limited to the entities it looks after.
Screenshots are retaken from IQ Entities on every release. Updated 14 October 2026.
The built-in roles cover most people, but a team often needs something narrower: an audit committee that reads everything and changes nothing, or a local team that looks after the English companies and no others. A role in IQ Entities answers two questions at once, what its holders may do and which entities they may do it to, and every member who holds the role follows it when you change it.
Decide first whether the team works across the whole group or on a part of it. If it is a part, describe that part as a rule (a jurisdiction, an entity type, the companies under one parent) rather than a list, so that a company added next year joins the role's reach without anyone remembering to add it.
Create the role
In Administration, open Roles & Permissions and choose New role. The page shows each existing role with how many permissions it holds, which entities it applies to and how many people hold it.
Type a Role name, then pick a starting point under Start from: Read-only, Editor, Administrator, External viewer or External (full). A preset fills the grid below; it does not tie the role to the preset, so you can change any box afterwards.
Adjust the grid. Each row is an area of the product and each column an action: Read, Write, Delete, Use and Manage. Click a column heading or a row name to toggle all of it in one go, or use All entity data to cover every register at once. A dash means that action does not exist for that area.
Choose Create role.
Limit it to some entities
A new role applies to every entity. To narrow it, open the role and change where it applies.
Choose the role's card on Roles & Permissions to open it.
Open Applies to.
Choose Only entities that match…. The change takes effect straight away, and until you save a rule the role reaches no entities, so have the rule ready before you do this to a role people already hold.
Under Membership rules, choose Define rules and pick the kind of condition: Jurisdiction, Entity type, Registration, Address, Incorporated, Field or Group structure, among others.
Fill in the condition and check the count beneath it: it names the entities that match right now. Choose Save rules to keep the condition. The number beside Applies to shows how many entities the role reaches.
If you changed any permissions on the role's own page, choose Save at the top of the role. Permission changes are not kept until you do.
| The team | What to choose |
|---|---|
| Works on every company in the group | All entities |
| Looks after the companies in one country | Only entities that match… with a Jurisdiction condition |
| Looks after one sub-group | Only entities that match… with a Group structure condition |
| Needs a condition that is "either A or B" | Two roles, one for each, held by the same people |
Give the role to people
A role reaches nobody until someone holds it. Give it to existing members from Members, as described in Change what a member can do, or choose it when you invite a colleague.
Tips from practice
- Built-in roles can be renamed and reshaped, but not deleted, because something may rely on them. A role you created can be deleted with Delete once nobody holds it.
- Some areas, such as tasks, offer an Only show choice under their row, which narrows what holders see within the entities they reach (for example, only tasks assigned to them).
- When a scoped role includes a permission that lets its holders see insights across the whole organisation, the role's page warns that it reaches past the role's entity scope. Read the warning before you save.
- Rename a role from the pencil beside its name so that its holders' role chips say what it is for.
- For a read-only role whose holders can ask IQ, tick the AI assistant row; see Let your directors find information with IQ.