# Roles & Permissions

> [!TIP]
> **Required Permissions**
>
> To manage roles and permissions, users must be in a role that has the "Administer Permissions" permission globally.



AzuraCast has a highly granular Access Control List (ACL) system that allows you to control the specific permissions of each group of users.

In summary, you can think of the access control list as working this way:

- One or more **Users** can be in a **Role**.
- Each **Role** has one or more **Permissions**, which gives everyone in that Role that level of access. Permissions can either be specific to a single station, or global for the entire installation.

The Roles & Permissions page has protections in place to prevent users from accidentally denying themselves permissions to the Permissions page itself.


## Special Permissions {#special-permissions}


There are special permissions that will grant access to other sections of the system, even when you don't explicitly grant those lower-level permissions to each user:

- The **All Permissions** global permission creates a super-user with access to all of the AzuraCast installation, and the **All Permissions** station-specific permission creates a super-user with full access to that specific station only.
- The **Manage Stations** global permission also allows the user to administer any stations that exist in the AzuraCast installation.


## Feature-Specific Permission Requirements {#feature-specific-permission-requirements}


AzuraCast has robust permission controls that prevent unauthorized access to critical station features:

- **Skip Current Track**: Requires the user to have the `manage station broadcasting` permission for a station.
- **Play Song Now / Add to Queue**: Requires the user to have the `manage station media` permission for a station.
- **Deleting Media**: While any user with the `manage station media` permission can visit the station's Media Manager interface, only users with the `delete station media` permission can remove existing files.