# Project Access Management

{% callout type="info" %}
This guide applies only to on-demand customers. If your organization has set up SSO, refer to the [SSO Guides](https://docs.statsig.com/access-management/sso/overview) for information about managing access permissions through SSO.
{% /callout %}

In the [Basic Settings page](https://console.statsig.com/settings) you can configure who has access to your project. Each person invited to a project receives a role that specifies their level of access.

## Roles

The different Project Roles available are:

| Role | Description |
|-----------|-------------|
| Read-Only | Users with this role can only read data on the project. This includes reading gate and dynamic config configurations, experiment data, and metrics. Any actions users with these roles take that attempt to edit the configuration for the project fail. |
| Member | Users with this role can read data for a project and edit configurations within the project. This includes being able to create and modify: Feature Gates, Dynamic Configs, Holdouts, Experiments+, etc. |
| Admin | Users with this role have the same access as `Member` but can also modify project access settings. This includes inviting new users to the project and changing roles for existing users of the project. |
| Owner | Only the user that created a project receives the `Owner` role. The Owner has the same access as `Admin` but can also delete the project and configure automatic invitations for the project. If you need to change the Owner of a project, the current owner can change it by going to *Settings > Project Members & Invites*, selecting the person, and editing their role to Owner. |

## Custom roles

{% callout type="info" %}
Custom roles are for Enterprise contracts only. Reach out to the support team, your sales contact, or the [Slack channel](https://statsig.com/community) to enable Enterprise features.
{% /callout %}

Enterprise customers can customize roles used to assign permissions in Statsig. You can create new roles beyond Admin, Member, and Read-Only and choose what permissions these roles have. Common use cases include creating a Metrics Admin role or a Warehouse Admin role (for Statsig Warehouse Native).

{% figure %}
![Custom roles configuration interface](https://docs.statsig.com/images/access-management/projects/1b5a0601-6311-401e-87e3-5d1055a025e7.png)
{% /figure %}

### Granular delete permission for configs

By default, the **Edit/Delete Configs** permission bundles editing, archiving, and deleting configs together. You can't independently control which of those actions a role can perform.

To separate **Delete Configs** into its own assignable permission, contact Statsig to enable the `delete_configs_permission` gate for your company. After Statsig enables it, the *Role Permissions* page shows **Delete Configs** as a standalone permission. You can then assign a role the ability to edit and archive configs without also giving it the ability to delete them.

## Automatic project invitations

To simplify sending invitations for a project, you can allow users creating a new Statsig account to automatically join your project if their work email domain matches the owner's. For example, a project owner with an `@statsig.com` email can enable all new users signing up with an `@statsig.com` email to automatically join their project.

To enable this feature:

1. Go to your [Project Basic Settings page](https://console.statsig.com/settings).
2. Click **Edit Project Settings**.
3. Toggle the checkbox labeled `Anyone who signs up with the same email domain can join` and choose the role that users receive.

{% figure %}
![Project settings automatic invitation configuration](https://docs.statsig.com/images/access-management/projects/128581866-b5856f1d-9ac6-462d-a57e-22320a093457.png)
{% /figure %}