# Privileges and Roles

> For the complete documentation index, see [llms.txt](https://developers.thoughtspot.com/docs/llms.txt)

Source: https://developers.thoughtspot.com/docs/privileges-and-roles

# Privileges and Roles

System privileges determine the workflows and actions that users can perform within the ThoughtSpot application context.

## Privileges

ThoughtSpot allows you to define several types of privileges:

-   Role-specific privileges for administrators, developers, and other user personas.
    
-   Data-related privileges to allow or prevent access to upload, download, or manage data.
    
-   Workflow-specific privileges to enable or disable access to features such as SpotIQ analysis, scheduling Liveboards, or the experimental features available for evaluation and early adoption.
    
-   Spotter-specific privileges to control access to Spotter and administer Spotter workflows.
    

For more information about privileges, see [Understand groups and privileges](https://docs.thoughtspot.com/cloud/latest/groups-privileges) and [Application control privileges]({{navprefix}}/{{roles}}#_application_control).

## Roles

Privileges can be assigned via [Roles](https://docs.thoughtspot.com/cloud/latest/rbac) and grouped using Role-Based Access Control (RBAC).

If RBAC is not enabled, administrators can configure [privileges](https://docs.thoughtspot.com/cloud/latest/groups-privileges) and assign them directly to groups.

## User and group shareability

**Shareable** is a property of a user or group object which controls visibility of users and groups in the **Share** dialog. If a user’s visibility and the group that they belong to is **Shareable** and the user initiating the share action also belongs to the same group, the user’s email address will be displayed in the **Share** dialog.

Users with administration or **Can share with all users** (`SHAREWITHALL`) privilege will see all users and groups in the **Share** dialog.

## Granular control of menu actions within browser

If you are using Visual Embed SDK to embed ThoughtSpot objects and you want to restrict user access to certain menu actions, you can use the `visibleActions`, `disabledActions` or `hiddenActions` attributes. For more information, see [Show or hide UI actions]({{navprefix}}/{{embed-actions}}).