---
title: "Team roles, permissions and approvals"
description: "Decide per area and per action what each colleague or freelancer can do. Let changes wait for approval and make two-factor authentication a team rule."
canonical_url: "https://dnsense.io/team-roles"
---

> Index of every page on this site: [llms.txt](https://dnsense.io/llms.txt)

<key-visual-subpage ctaHref="https://app.dnsense.io/" ctaIcon="ArrowUpRight" ctaLabel="Start for free" description="A junior can fix a TXT record without being able to delete a provider connection. A freelancer can propose a change without pushing it live. You draw those lines yourself." highlight="Exactly the access" imageAlt="Team settings with two-factor authentication required and the member list" imageUrl="feature-roles-hero.webp" title="Exactly the access they need, nothing more">



</key-visual-subpage>

<feature-rows :rows="[{"title":"Ready on day one","titleIcon":"User","description":"A new team starts with Owner, Admin, Member and Viewer already set up. Most teams never need more. The ones that do add their own role next to them.","imageUrl":"feature-roles-starter.webp","imageAlt":"Roles overview with Owner, Admin, Member, Viewer and a custom Freelancer role","bullets":["Owner holds every permission and cannot be edited, so a team never locks itself out","Member works the DNS data without administering the team","Viewer reads everything and changes nothing, useful for a client or an auditor"]},{"title":"Permissions per area, per action","titleIcon":"LockKeyhole","description":"View, create, edit and delete are set separately for connections, zones, templates, schedules, domains, spaces and the team itself. Rename a role, build a new one or take one permission away.","imageUrl":"feature-roles-matrix.webp","imageAlt":"Permission matrix of a Freelancer role","bullets":["Team settings, members and roles kept apart from the DNS work","Changes apply straight away, on every screen and API call","Adding a colleague costs nothing, DNSense never charges per user"]},{"title":"Changes that wait for a second pair of eyes","titleIcon":"ShieldCheck","description":"Give a role \"Changes require approval\" and its record changes are held back instead of sent to the provider. Someone with \"Can approve changes\" reviews them and lets them through or turns them down.","imageUrl":"feature-roles-approvals.webp","imageAlt":"Approvals queue with changes waiting for review","bullets":["The team is notified the moment a change is waiting","See the change before and after, then approve or reject it","Approvals and rejections are written to the audit log"]},{"title":"Two-factor as a team rule","titleIcon":"LockKeyhole","description":"Switch the requirement on and a member without two-factor authentication keeps their role but cannot act in the team until they set it up. Not a reminder mail they can ignore, an actual gate.","imageUrl":"feature-roles-2fa.webp","imageAlt":"Team security setting that requires two-factor authentication","bullets":["One switch in team settings, applied to everybody at once","Members see what is missing and where to set it up","Changing the requirement is written to the audit log"]}]" highlight="shape them to your team" label="Team roles" title="Four roles to start with, then shape them to your team">



</feature-rows>

<faq :faqs="[{"question":"How many users can I add to my team?","answer":"As many as you like. DNSense charges for the number of domains and zones you manage, never per user."},{"question":"Can I create my own roles?","answer":"Yes. The four starter roles are a starting point. Rename them, change their permissions or add a role of your own, like a Freelancer whose changes need approval."},{"question":"Who can approve a change?","answer":"Every member whose role has the \"Can approve changes\" permission. Owners have it by default."},{"question":"Can somebody lock the team out by mistake?","answer":"No. The Owner role always keeps the full set of permissions and cannot be edited, and whoever manages team security can always switch the two-factor requirement back off."}]" decorativeShape="bottom-left" label="Questions" title="Frequently asked questions about team roles">



</faq>

## Sitemap

See the full [sitemap](https://dnsense.io/sitemap.md) for all pages.