# Auditor

The **Auditor** reads everything and changes nothing. Every permission in the
organization family and every resource class is held at the view level, so an
**Auditor** can inspect the organization, its members, its audit log, and all of
its resources without being able to alter any of them. It holds nothing in the
deployment family.

This is the role to grant for review and compliance work, where visibility is
the requirement and any ability to make a change is a liability.

## Organization

| Permission                      | Access |
| ------------------------------- | ------ |
| Organization                    | View   |
| Members                         | View   |
| Audit log                       | View   |
| Data residency                  | View   |
| Restore points legal holds      | View   |
| Inventory resources legal holds | View   |

## Resources

| Permission            | Access |
| --------------------- | ------ |
| Inventories           | View   |
| Apps                  | View   |
| Restore point data    | View   |
| Secret Providers      | View   |
| Integrations          | View   |
| Policies              | View   |
| Settings              | View   |
| Edges                 | View   |
| Configuration bundles | View   |
| Data classes          | View   |
| Environments          | View   |
| Schedules             | View   |

## Deployment

| Permission    | Access    |
| ------------- | --------- |
| Control plane | No access |
| License       | No access |