# User Management

There are **three** different roles in the TrapEye Deception Platform.  
Here’s what you need to know about them to correctly configure your tenant.

---

## 1. Reviewer Role

The **Reviewer** role is **read-only**.  
Users with this role **cannot**:  

- Classify threats  
- Install devices  
- Modify tenant settings  
- Create, modify, or delete users  
- Create integrations  

This role is ideal for users who only need to view data without making changes.

## 2. Analyst Role

The **Analyst** role includes all permissions of the **Reviewer**, plus the ability to:  

- Classify threats 
- Manage whitelists  

**Limitations:** Analysts **cannot** modify tenant settings or manage users/devices/policies.

## 3. Administrator Role

The **Administrator** role includes all permissions of the **Analyst**, plus the ability to:  

- Manage all users (create, delete, change passwords)
- Install new devices
- Manage policies and integrations 
- Create sub-organizations in multi-tenant mode  
- Configure all tenant settings  

Administrators have **full read and write access** across the entire tenant.

## Permission Inheritance in Multi-Organization Mode

In **multi-tenant deployments**, roles assigned at the parent organization level **automatically apply** to all child organizations.

For example, an **Analyst** in a parent organization can classify threats in every child organization.