[Yandex Cloud documentation](../../index.md) > [Yandex Security Deck](../index.md) > [Access management](index.md) > CSPM roles

# Cloud Security Posture Management (CSPM) service roles

With [CSPM](../concepts/cspm.md) service roles, you can manage user access to the CSPM resources and their settings, as well as to the results of configuration compliance checks with [security standards](../concepts/cspm.md#standards).

```mermaid
flowchart BT
    cspm.admin --> security-deck.admin
    cspm.editor --> security-deck.editor
    cspm.editor --> cspm.admin
    cspm.viewer --> security-deck.viewer
    cspm.viewer --> cspm.editor
    cspm.auditor --> security-deck.auditor
    cspm.auditor --> cspm.viewer
    cspm.worker --> security-deck.worker

    security-deck.auditor --> security-deck.viewer
    security-deck.viewer --> security-deck.editor
    security-deck.editor --> security-deck.admin

    security-deck.auditor ~~~ security-deck.admin
```

#### cspm.worker {#cspm-worker}

The `cspm.worker` role allows the user to view the [organization](../../organization/concepts/organization.md) info, view the list of [clouds](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folders](../../resource-manager/concepts/resources-hierarchy.md#folder) and their info as controlled resources of a Security Deck [workspace](../concepts/workspace.md).

The role is issued to the [service account](../../iam/concepts/users/service-accounts.md) to perform checks for compliance with [security standards](../concepts/cspm.md#standards) configured in [CSPM](../concepts/cspm.md) settings and extends to an organization, cloud, or folder.

#### cspm.auditor {#cspm-auditor}

The `cspm.auditor` role enables viewing info on cloud infrastructure checks for compliance with [security standards](../concepts/cspm.md#standards), as well as on jobs for such checks configured in the [CSPM](../concepts/cspm.md) settings.

#### cspm.viewer {#cspm-viewer}

The `cspm.viewer` role enables viewing info on cloud infrastructure checks for compliance with [security standards](../concepts/cspm.md#standards) and their results, as well as on jobs for such checks and [exceptions](../concepts/cspm.md#exceptions) from check rules configured in the [CSPM](../concepts/cspm.md) settings.

This role includes the `cspm.auditor` permissions.

#### cspm.editor {#cspm-editor}

The `cspm.editor` role enables managing jobs for cloud infrastructure checks for compliance with CSPM security standards and exceptions from related rules, as well as running such checks manually.

Users with this role can:
* View info on cloud infrastructure checks for compliance with [security standards](../concepts/cspm.md#standards) configured in the [CSPM settings](../concepts/cspm.md), as well as delete checks.
* View info on CSPM check jobs.
* Manually run checks for compliance with CSPM security standards.
* View CSPM check results.
* Create, suspend, resume, modify, and delete CSPM check jobs.
* View [exceptions](../concepts/cspm.md#exceptions) from CSPM check rules, as well as create and delete such exceptions.

This role includes the `cspm.viewer` permissions.

#### cspm.admin {#cspm-admin}

The `cspm.admin` role enables managing jobs for cloud infrastructure checks for compliance with CSPM security standards and exceptions from check rules, as well as running such checks manually.

Users with this role can:
* View info on cloud infrastructure checks for compliance with [security standards](../concepts/cspm.md#standards) configured in the [CSPM settings](../concepts/cspm.md), as well as delete checks.
* View info on CSPM check jobs.
* Manually run checks for compliance with CSPM security standards.
* View CSPM check results.
* Create, suspend, resume, modify, and delete CSPM check jobs.
* View [exceptions](../concepts/cspm.md#exceptions) from CSPM check rules, as well as create and delete such exceptions.

This role includes the `cspm.editor` permissions.