[Yandex Cloud documentation](../../index.md) > [Yandex Security Deck](../index.md) > [Access management](index.md) > KSPM roles

# Kubernetes® Security Posture Management (KSPM) service roles

With [Kubernetes® Security Posture Management](../concepts/kspm.md) (KSPM) service roles, you can manage user access to the KSPM resources and their settings, as well as to the data contained in the control results and alerts.

```mermaid
flowchart BT
    kspm.admin --> security-deck.admin
    kspm.editor --> kspm.admin
    kspm.editor --> security-deck.editor
    kspm.viewer --> kspm.editor
    kspm.viewer --> security-deck.viewer
    kspm.auditor --> kspm.viewer
    kspm.auditor --> security-deck.auditor
    kspm.worker --> security-deck.worker

    security-deck.auditor --> security-deck.viewer
    security-deck.viewer --> security-deck.editor
    security-deck.editor --> security-deck.admin

    security-deck.auditor ~~~ security-deck.admin
```

#### kspm.worker {#kspm-worker}

The `kspm.worker` role allows the user to view info on Managed Service for Kubernetes [clusters](../../managed-kubernetes/concepts/index.md#kubernetes-cluster) and install [KSPM](../concepts/kspm.md) components in them.

The role is issued to the [service account](../../iam/concepts/users/service-accounts.md) to perform cluster checks and extends to an organization, cloud, or folder. This service account should be specified when [creating](../operations/workspaces/create.md) the workspace.

#### kspm.auditor {#kspm-auditor}

The `kspm.auditor` role allows the user to view info on [KSPM](../concepts/kspm.md) settings, KSPM operations, and the list of exceptions from the rules.

#### kspm.viewer {#kspm-viewer}

The `kspm.viewer` role allows the user to view info on [KSPM](../concepts/kspm.md) settings, Managed Service for Kubernetes [clusters](../../managed-kubernetes/concepts/index.md#kubernetes-cluster) connected to KSPM, exceptions from the rules, exceptions from the scope of control, KSPM users, and KSPM operations.

This role includes the `kspm.auditor` permissions.

#### kspm.editor {#kspm-editor}

The `kspm.editor` role allows the user to engage, set up, and disconnect [KSPM](../concepts/kspm.md), create, modify, and delete exceptions from the rules and exceptions from the scope of control, view info on Managed Service for Kubernetes [clusters](../../managed-kubernetes/concepts/index.md#kubernetes-cluster) connected to KSPM, KSPM users, and KSPM operations.

This role includes the `kspm.viewer` permissions.

#### kspm.admin {#kspm-admin}

The `kspm.admin` role allows the user to engage, set up, and disconnect [KSPM](../concepts/kspm.md), create, modify, and delete exceptions from the rules and exceptions from the scope of control, view info on Managed Service for Kubernetes [clusters](../../managed-kubernetes/concepts/index.md#kubernetes-cluster) connected to KSPM, KSPM users, and KSPM operations.

This role includes the `kspm.editor` permissions.