---
title: Security model overview
related:
  - https://docs.kentico.com/k8/securing-websites/designing-secure-websites/configuring-permissions-securely.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Kentico provides a flexible security model that allows you to configure granular access permissions for pages and applications in the administration interface.\
The security model consists of:

- [users](https://docs.kentico.com/k8/managing-users/user-management.md) (shared among websites)
- [roles ](https://docs.kentico.com/k8/managing-users/role-management.md)(defined for websites or globally for all sites in the system)
- [memberships ](https://docs.kentico.com/k8/managing-users/membership-management.md)(collections of roles that can be assigned to users)
- [module permissions](https://docs.kentico.com/k8/managing-users/configuring-permissions.md) (permissions for specific features in Kentico)
- [document permissions](https://docs.kentico.com/k8/managing-users/configuring-permissions/configuring-document-permissions.md) (ACLs and content and document types permissions)
- [UI personalization](https://docs.kentico.com/k8/managing-users/ui-personalization.md) (hiding components of the user interface)

## Relationships between users, roles and permissions

The following figure shows how users are assigned to roles and how permissions for documents and applications are granted to users and roles:

![](https://docs.kentico.com/docsassets/k8/security-model-overview/1.png)

**Users** can be members of any number of roles. Permissions for particular documents (pages) can be granted to users directly. If you want to grant module permissions to a user, you need to make the user a member of a role, and grant the permissions to the role.

> **Note:** Each user has a [privilege level](https://docs.kentico.com/k8/managing-users/user-management.md) that controls access to the administration interface, and can override permission requirements (for administrator levels).

**Roles** in Kentico are fully customizable. You are not limited to a predefined set of roles. Instead, you can define your own roles with custom sets of permissions.

If a user is a member of multiple roles, their **permissions for modules** are calculated as a sum of all permissions granted to all roles.

If **permissions for documents** in Kentico repository are granted to both a user and their roles, document permissions are calculated as a sum of all permissions granted to the user and to all roles. If you **deny a document permission** for a user or one of their roles, then the result is always "denied" for the given permission, even if some of the roles are allowed to perform the action.