---
layout: docs
page_title: Configuration
sidebar_title: Roles
description: |-
  How to configure Boundary roles
---

# Roles

A role is a collection of capabilities granted to any Principal the Role is assigned to. A Role belongs to one and only one Scope. A Role owns zero or more Direct Grants. A Role can be assigned to zero or more Principals. A Principal assigned a Role receives all capabilities granted by any Direct Grant owned by the Role. A Role is deleted when the Scope it belongs to is deleted. All Direct Grants owned by a Role are deleted when the Role is deleted. The lifecycle of a Role is not tied to the lifecycle of any Principal.

```shell-session
+---------------------------------+
|           Organization          |
+----------------+----------------+
|     Role 1     |     Role 2     |
+----------------+----------------+
```

## Attributes

### ID

A role is prefixed with `r_` followed by ten digits.

Example: `r_0123456789`

### Users

A role can have zero or more users associated with it.

### Groups

A role can have zero or more groups assocaited with it.

### Grants

A role can have zero or more grants associated with it.