> ## Documentation Index > Fetch the complete documentation index at: https://tyk.io/docs/llms.txt > Use this file to discover all available pages before exploring further. # User Permissions > Learn how to configure and enforce role-based access control (RBAC) for Tyk Dashboard users, including admin users and custom permissions The Tyk Dashboard is multi-tenant capable and allows granular, role based user access. Users can be assigned specific permissions to ensure that they only have very specific access to the Dashboard pages, and to the underlying API. It is important to note that all user roles are defined and enforced **at the Dashboard API level**, and the UI is merely reactive. ## Admin Users An *admin* user has read and write access to all properties. The initial user created during the dashboard's bootstrapping process is automatically assigned the *admin* role. There are two configuration parameters that restrict the admin user’s capabilities. For enhanced security, both of these values should be set to `true`: * [security.forbid\_admin\_view\_access\_token](/docs/tyk-dashboard/configuration#security-forbid_admin_view_access_token): This parameter restricts admin users from viewing other users' Dashboard API Access Credentials, both in the API and the UI. * [security.forbid\_admin\_reset\_access\_token](/docs/tyk-dashboard/configuration#security-forbid_admin_reset_access_token): This parameter prevents admin users from resetting the access tokens of other users. ## User permissions in the Tyk Dashboard API The permissions object, which is provided to the Dashboard API has this structure: ```json theme={null} "user_permissions": { "IsAdmin": "false", "analytics": "read", "apis": "write", "hooks": "write", "idm": "write", "keys": "write", "policy": "write", "portal": "write", "system": "write", "users": "write", "user_groups": "write", "audit_logs": "read" } ``` Note that the above list may not be complete as more features and flexibility are added to the Tyk Dashboard. The way the permissions object works is that: * if it contains `"IsAdmin":"true"`, the user is an *admin* * if it contains no properties, the user is assumed to be an *admin* * if it contains even just one property, it acts as an allow-list: only the listed properties are allowed * any non-listed properties are denied * permissable values for each section (other than `IsAdmin`) are: `read` or `write`; to deny access to a property you must remove the property from the `user_permissions` object An *admin* user can be identified either by setting `IsAdmin` to `true` or by setting no properties in the `user_permissions` object. ## User permissions in the Tyk Dashboard UI User permissions are configured in the user detail view: Admin account The configuration of each property will affect the dashboard navigation, with `denied` sections or screens hidden or disabled. Note that some side-effects can occur if pages that make use of multiple APIs to fetch configuration data cross over e.g. policies and API Definition listings. Selecting the **Account is Admin** checkbox from the Dashboard gives the user full access (it has the same [effect](/docs/platform-management/user-permissions#admin-users) as the `IsAdmin` property). ## Custom User Permissions You can create your own custom permissions for use with the [Open Policy Agent (OPA)](/docs/platform-management/open-policy-agent) using the [Additional Permissions](https://tyk.io/docs/api-reference/additional-permissions/list-additional-permissions) endpoint in the Tyk Dashboard Admin API. This allows you to add and delete (CRUD) a list of additional (custom) permissions for your Dashboard users. Once created, a custom permission will be added to standard list of user permissions. You can also configure these custom permissions in the `security.additional_permissions` [map](/docs/tyk-dashboard/configuration#security-additional_permissions) in the Tyk Dashboard configuration file.