> ## Documentation Index
> Fetch the complete documentation index at: https://docs.up.telestream.com/llms.txt
> Use this file to discover all available pages before exploring further.
# creating-roles-and-permissions
> Control what each user can do, both organization-wide and per Space.
## What this video covers
This video explains the two layers that determine access in UP, and shows how to build a **Role** and a **Group** in **Settings → Roles / Groups**.
## Good to know
UP separates *platform-level* access from *content-level* access:
* **Organization Permissions** (set up in **Roles**, assigned directly to a user in **Users**) control admin/platform-level access — things like who can manage billing or user management itself.
* **Spaces and per-space roles** (assigned via **Groups**) control what a user can actually do inside a given **Space**. There's no per-space setting on the Users form — it always goes through a Group.
A Role sets a permission level — typically **Manage**, **Edit**, **View**, or **No access** — per application. Once created, a Role shows up as an option in the **Organization Permissions** field when you add or edit a user.
A Group bundles a set of users with a shared set of Space + role assignments, so you can grant a whole team access to the right Spaces at once instead of configuring each person individually. Every Space you add to a Group needs at least one role attached to it. One Group can be marked as the **default** — new users land in it automatically — and the default Group can't be deleted.
Usually both: a Role if they need any admin/platform capability, and membership in a Group if they need to work inside specific Spaces.
Building the Space first makes this step easier — you'll need at least one Space to attach to a Group's role assignment.
## Next step
With access under control, connect the storage your Spaces will use — continue to [Adding Storages](/up-academy/adding-storages).
## Related documentation
Full reference for Roles, Groups, Spaces, and how they interact.