---
title: "Express Role Administration"
slug: "express-role-administration"
description: "Manage Express roles effectively with parent-child hierarchy, default permissions, and full submission access in Role Administration. Contact your admin for access."
tags: ["administration", "rbac"]
status: "update"
updated: 2026-10-09T16:14:27Z
published: 2026-10-09T16:14:27Z
canonical: "docs.unqork.io/express-role-administration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Express Role Administration

To access Express Role Administration, navigate to **Administration** > **Express Permissions** > **Express Role Administration**.

The Express Role Administration page is where administrators manage the roles that control what end-users can access. Express roles support a parent-child hierarchy, default permission levels, group assignments, and full submission access for privileged roles.

> [!WARNING]
> Managing Express roles requires administrative permissions. Administrators needing access should contact their environment administrator.

## Role List

The role list displays all Express roles in the environment. Use the search bar to filter roles by name. Each row displays the following:

| Column | Description |
| --- | --- |
| **Role** | The role name. |
| **Description** | The role description, if provided. |
| **Permission** | The default permission level assigned to end-users with this role. |
| **Actions** | Role-level actions. See [Role Actions](/unqorkai/docs/express-role-administration#role-actions) below. |

### Page Actions

| Action | Description |
| --- | --- |
| **Add Role** | Opens a new page to create a new Express role. |

The toolbar also includes the following actions:

| Action | Description |
| --- | --- |
| **Promote All Roles** | Promotes all Express roles to another environment. |
| **View Role Hierarchy** | Opens a dialog showing the parent-child hierarchy of every Express role, with collapsible branches. |

### Role Actions

| Action | Description |
| --- | --- |
| **Edit** | Opens the role form to update its settings. |
| **Delete** | Permanently removes the role. A role cannot be deleted if it is currently assigned to any end-users. |

## Adding a Role

Click **Add Role** to open a form with the following settings:

| Setting | Description |
| --- | --- |
| **Role Name** | A unique identifier for the role. Cannot be changed after creation. |
| **Role Description** | An optional description of the role's purpose. |
| **Select Parent** | Assigns a parent role (a role whose permissions this role inherits). A role with a parent is called a child role. Child roles inherit all permissions from their parent while also carrying any permissions assigned directly to them. |
| **Select Default Permission** | Sets the baseline access level for end-users with this role. |
| **Full Submission Access** | Grants unrestricted read and write access to all submissions. |
| **Add to Group(s)** | Search for and assign the role to or more Express groups. |

### Default Permission

The default permission sets the baseline access level for end-users assigned this role.

| Option | Description |
| --- | --- |
| **No Access** | End-users cannot view or interact with any submissions. |
| **Read-Only** | End-users can view submissions but cannot modify them. |
| **Write** | End-users can view and modify submissions. |

### Full Submission Access

When enabled, Full Submission Access grants unrestricted read and write access to all submissions in the environment, overriding role hierarchy, group membership, and field-level permissions.

> [!WARNING]
> Full Submission Access bypasses all other access controls. Enable it when this level of access is explicitly required.

Enabling Full Submission Access automatically sets the Default Permission to **Write** and prevents it from being changed.

## Role Hierarchy

Express roles support a parent-child hierarchy. A child role inherits the permissions of its parent. To assign a parent, select from the **Select Parent** drop-down when creating or editing a role.

Select **View Role Hierarchy** from the toolbar to see the full hierarchy across all roles in the environment.

---

**Changelog**

| Date | Change |
| --- | --- |
| 2026-08-27 | Corrected View Role Hierarchy access — inline toolbar button, not ellipsis drop-down (EN-8047). |
| — | Initial publication. |

The Unqork front-end application framework that delivers Creator-built applications to end-users. Express is the layer end-users interact with—the published forms, screens, and navigation built in the Module Builder. Express is distinct from Express View, which is a Creator-facing preview tool in the IDE.

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.

## Related

- [Environment-Level Role-Based Access Control (RBAC)](/environment-level-role-based-access-control-rbac-unqork.md)
- [Express Role-Based Access Control (RBAC) Overview](/express-role-based-access-control-rbac-overview.md)
- [Module-Level Role-Based Access Control (RBAC)](/module-level-role-based-access-control-rbac.md)