[Yandex Cloud documentation](../../index.md) > [Yandex Security Deck](../index.md) > [Access management](index.md) > CIEM roles

# Roles for Cloud Infrastructure Entitlement Management (CIEM)

Only [organization members](../../organization/concepts/membership.md) who have the `organization-manager.viewer` [role](../../organization/security/index.md#organization-manager-viewer) or higher for the organization can [view](../operations/ciem/view-permissions.md) access permissions in the [Security Deck interface](https://center.yandex.cloud/security/iam-diagnostics/).

To [revoke](../operations/ciem/revoke-permissions.md) access permissions, users must have one of these roles: `admin`, `resource-manager.admin`, `organization-manager.admin`, `resource-manager.clouds.owner`, `organization-manager.organizations.owner`, or the administrator role in the [service](../../overview/concepts/services.md) where they want to revoke the subject’s access to a resource.