Most of the time, Tines 3B's built-in roles cover what you need. But when you want to grant a specific mix of permissions that no built-in role matches, you can create a custom role. A custom role is your own named bundle of permissions for one kind of resource, and once you create it, it shows up alongside the built-in roles everywhere you grant that kind of access.
Note: Creating and managing custom roles requires the "Manage roles" permission. If you don't have it, you can still see roles but not create, assign through, or delete them.
How custom roles work
A custom role is tied to a single kind of resource, the same way built-in roles are. A role you build for spaces can only be granted on spaces, a role for connectors only on connectors, and so on. This keeps things predictable: you can't accidentally mix a space permission into a connector role.
You can build custom roles for spaces, connectors, skills, networks, groups, and service accounts. You can also build tenant-wide roles, which is covered near the end.
Create a custom role, go to settings, then roles. Select the plus button, then choose the kind of resource the role is for.
Give the role a clear, descriptive name, for example "Space commenter."
Turn on the permissions you want the role to include and select Create.
The role is available immediately, so you can start assigning it right away.
What you can and can't include
A few rules shape what a custom role can hold:
Only relevant permissions appear. The permissions list is scoped to the resource type you picked, so you only see options that make sense for it.
The "view" permission is always included. Every role has to let its holder at least see the resource, so the matching view permission is switched on and can't be turned off.
Full tenant access is off limits. Custom roles can never carry full tenant access or the "manage all spaces" capability. Those stay exclusive to the Admin role.
Names must be unique. Two roles can't share a name.
Assign a custom role
Once created, a custom role behaves just like a built-in one. When you grant access to a resource of the matching type, your custom role appears in the same role picker as the built-in roles. Pick it there and grant it to a person or a group as usual.
Delegate tenant-wide capabilities
Custom roles aren't only for individual resources. You can create a tenant-wide role that bundles capabilities like creating spaces, creating connectors, or managing members, then assign it to a group or a person. This is the way to delegate specific administrative abilities without handing someone the full Admin role. Because these permissions apply across your whole tenant, build these roles carefully and assign them sparingly.
Read how to delegate tenant permissions here.
Change a custom role
A custom role's permissions are set when you create it and can't be edited afterward. To change what a role grants, create a new role with the permissions you want, assign it to the same people or groups, then delete the old one.
Delete a custom role
You can delete a custom role from the Roles list or from the role's own view.
Note: You can't delete a role while it's still assigned to anyone.
Remove it from every group, member, and service account first, then delete it. Deleting a role is permanent.