---
title: Role-based access control (RBAC)
description: 'How InfluxDB 3 Enterprise role-based access control (RBAC) works: built-in roles and the permissions model for multi-user authentication.'
url: https://docs.influxdata.com/influxdb3/enterprise/reference/internals/rbac/
estimated_tokens: 654
product: InfluxDB 3 Enterprise
version: enterprise
publisher: InfluxData
canonical: https://docs.influxdata.com/influxdb3/enterprise/reference/internals/rbac/
date: '2026-09-30T11:02:06-04:00'
lastmod: '2026-09-30T11:02:06-04:00'
---

> [!Note]
> #### RBAC applies to multi-user authentication
>
> Role-based access control governs users signed in through multi-user
> authentication, which is **off by default** in InfluxDB 3 Enterprise. Existing`apiv3_` token workflows are unaffected. See[Manage users and authentication](/influxdb3/enterprise/admin/security/manage-users/)to enable it.

Role-based access control (RBAC) governs what authenticated users can do in
InfluxDB 3 Enterprise. Each user is assigned one or more built-in roles that
determine their permissions.

## Built-in roles

InfluxDB 3 Enterprise provides three built-in roles:

* **Admin**: Full access to all resources, including creating and managing
  other users, roles, and tokens.
* **Auditor**: Can list and describe databases and read tokens, users, and
  roles. Can’t query or write data.
* **Member**: Can query and write data and create databases, and can
  create, read, and delete tokens. Can read users and roles. Can’t delete
  databases or manage users, roles, or admin tokens.

> [!Important]
> #### Auditor and Member grant less than their names suggest
>
> Only the **Admin** role (or an admin token) has full access. The**Auditor** role can’t read data, and neither **Auditor** nor **Member**can access system endpoints such as `/health`, `/metrics`, `/ping`, and`/ready`, or query the `_internal` database. Use an admin token for user
> and role management.

## Assign roles

Assign roles to a user with the `influxdb3 update user-roles` command. See[Manage users and authentication](/influxdb3/enterprise/admin/security/manage-users/)for the user-management workflow.

## Custom roles

Authoring custom roles (creating roles and editing role permissions) is
disabled by default (`--rbac-authoring-disabled` defaults to `true`).
Listing roles and assigning the built-in roles to users remain available
regardless of this setting.
See[configuration options](/influxdb3/enterprise/reference/config-options/#rbac-authoring-disabled)for details.

## Limitations

RBAC has the following known limitation in InfluxDB 3 Enterprise:

* **Token scope can exceed role scope**: A user with token-creation
  permission (**Admin** or **Member**) can create a token with
  database-level permissions broader than their own role.
  InfluxDB 3 Enterprise only restricts non-admin users from creating tokens
  that grant system-resource permissions.

#### Related

* [Manage users and authentication](/influxdb3/enterprise/admin/security/manage-users/)
* [InfluxDB 3 Enterprise authentication and authorization](/influxdb3/enterprise/reference/internals/authentication/)