---
title: Permission model overview
related:
  - https://docs.kentico.com/13/securing-websites/designing-secure-websites/configuring-permissions-securely.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Xperience provides a flexible security model that allows you to configure granular access permissions for pages and applications in the administration interface.

The security model consists of:

- [Users](https://docs.kentico.com/13/managing-users/user-management.md) (shared among websites)
- [Roles](https://docs.kentico.com/13/managing-users/role-management.md) (defined for websites or globally for all sites in the system)
- [Memberships](https://docs.kentico.com/13/managing-users/membership-management.md) (collections of roles that can be assigned to users)
- [Module permissions](https://docs.kentico.com/13/managing-users/configuring-permissions.md) (permissions for specific features in Xperience)
- [Page permissions](https://docs.kentico.com/13/managing-users/configuring-permissions/configuring-page-permissions.md) (ACLs, content and page type permissions)
- [UI personalization](https://docs.kentico.com/13/managing-users/ui-personalization.md) (hiding components of the user interface)

## Relationships between users, roles and permissions

The following figure shows how users are assigned to roles and how permissions for pages and applications are granted to users and roles:

![Permissions model in Kentico](https://docs.kentico.com/docsassets/13/permission-model-overview/security-model-overview-identity-mvc.png "Permissions model in Kentico")

**Users** can be members of any number of roles. Permissions for particular pages can be granted to users directly. If you want to grant module permissions to a user, you need to make the user a member of a role, and grant the permissions to the role.

> **Note:** Each user has a [privilege level](https://docs.kentico.com/13/managing-users/user-management.md) that controls access to the administration interface, and can override permission requirements (for administrator levels).

**Roles** in Xperience are fully customizable. You are not limited to a predefined set of roles. Instead, you can define your own roles with custom sets of permissions.

If a user is a member of multiple roles, their **permissions for modules** are calculated as a sum of all permissions granted to all roles.

If permissions for pages are granted to both a user and their roles, page permissions are calculated as a sum of all permissions granted to the user and to all roles. If you **deny a page permission** for a user or one of their roles, then the result is always "denied" for the given permission, even if some of the roles are allowed to perform the action.