[Yandex Cloud documentation](../../index.md) > [Yandex Security Deck](../index.md) > [Access management](index.md) > TD roles

# Service roles for Threat Detector (TD)

With [Threat Detector](../concepts/threat-detector.md) (TD) service roles, you can manage user access to the KSPM resources and their settings, as well as to the data on detected threats.

```mermaid
%%{init: {"flowchart": {'defaultRenderer': 'elk'}} }%%
flowchart BT
    threat-detector.admin --> security-deck.admin
    threat-detector.editor --> security-deck.editor
    threat-detector.viewer --> security-deck.viewer
    threat-detector.auditor --> security-deck.auditor
    threat-detector.worker --> security-deck.worker

    security-deck.auditor --> security-deck.viewer
    security-deck.viewer --> security-deck.editor
    security-deck.editor --> security-deck.admin

    threat-detector.editor --> threat-detector.admin
    threat-detector.viewer --> threat-detector.editor
    threat-detector.auditor --> threat-detector.viewer

    security-deck.auditor ~~~ security-deck.admin
```

#### threat-detector.worker {#threat-detector-worker}

The `threat-detector.worker` enables viewing logs registered in the customer's infrastructure using [Yandex Audit Trails](../../audit-trails/index.md).

The role is issued to the [service account](../../iam/concepts/users/service-accounts.md) to perform Threat Detector-driven security management and extends to an organization, cloud, or folder. This service account should be specified when [creating](../operations/workspaces/create.md) the workspace.

#### threat-detector.auditor {#threat-detector-auditor}

The `threat-detector.auditor` role enables viewing info on [Threat Detector](../concepts/threat-detector.md) security management rules and [access permissions](../../iam/concepts/access-control/index.md) granted for Threat Detector.

#### threat-detector.viewer {#threat-detector-viewer}

The `threat-detector.viewer` role enables viewing info on [Threat Detector](../concepts/threat-detector.md) security management rules and [access permissions](../../iam/concepts/access-control/index.md) granted for Threat Detector.

This role includes the `threat-detector.auditor` permissions.

#### threat-detector.editor {#threat-detector-editor}

The `threat-detector.editor` role enables viewing info on [access permissions](../../iam/concepts/access-control/index.md) granted for [Threat Detector](../concepts/threat-detector.md) and its security management rules, as well as creating exceptions from such rules.

This role includes the `threat-detector.viewer` permissions.

#### threat-detector.admin {#threat-detector-admin}

The `threat-detector.admin` role enables viewing info on [Threat Detector](../concepts/threat-detector.md) security management rules, creating exceptions from such rules, as well as viewing info on [access permissions](../../iam/concepts/access-control/index.md) granted for Threat Detector and modifying them.

This role includes the `threat-detector.editor` permissions.