# Grant access to specific resources

> Give a role access to selected positions, connections, or other resources, then test its permissions.

Use specific permissions when a role needs access to selected resources rather than every resource of that type. For example, give an operator access to one position without granting access to all positions. For general permissions, see Create roles and assign permissions . Before you begin A role already created and permission to manage it. A list of the resources the role needs to access. Which resource types support specific permissions Positions, Shared Sections, Connections, NMOS Connections, Surfaces, Workflows, and Cuelists offer a Specific card alongside their All card. Tags, Routing, Users, Roles, and Projects do not offer individual-resource controls in this editor. Their permission levels and action toggles apply to all resources of that type. System Admin uses a similar card for predefined system capabilities, such as General, SSO, and Backups. These rows are settings and administrative functions, not resources you create. Grant access to a specific resource Open Auth → Roles and select the role. Select the resource type, such as Position . Find the resource in the Specific Positions card. Use the search box to search by name. Select Read or Update for that resource. For a Workflow or Cuelist, enable Execute if the role needs to run it. Execute requires at least Read access. Repeat for any other resources the role needs. Save the changes. Each resource has its own row. There is no bulk or folder selection. Specific permissions do not offer Delete . In this editor, Delete is available only through the All card and applies to every resource of that type. Combine general and specific permissions Specific permissions add access. They cannot reduce access granted through the All card. For example, set All Positions to Read , then select Update for one position. The role can view every position but edit only that one. No access is unavailable in the individual rows because the role already has general Read access. To grant access only to selected positions, leave All Positions at No access and configure the individual rows. Execute is separate from the Read, Update, and Delete levels. General Delete access does not grant permission to execute a Workflow or Cuelist. Check the result Sign in with a non-administrator test account assigned only the role you want to check. Verify that it can perform the intended actions and cannot access resources outside the role's scope. Do not test by adding the role to your administrator account. Other roles can grant additional access, and System Administrator access is independent of role permissions. If you get stuck What you see What to try You cannot find a resource in the search. Search by its current name and check that you selected the correct resource type. An individual access level is disabled. Check the All card first. Individual permissions cannot reduce general access. Permission controls are locked. You cannot edit a role assigned to your own account. Ask another administrator to make the change. You also cannot grant permissions beyond your own access. Where to go next Create roles and assign permissions Show different controls by role