> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.

# List of Built-in Roles

> Reference table of the built-in xorlab roles and the capabilities each one grants.

To create a new custom role, see [Create a Custom Role](/latest/create-custom-user-role).

| xorlab role                       | Identifier                 | Capabilities                                                                                                                                                                                                                                                                                                                                                                                           |
| --------------------------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| User                              | `xcc_analyst`              | - Release emails from quarantine<br />- Reanalyze/Unlock emails<br />- Send feedback for reported incidents<br />- Submit misclassification reports<br />- Create, delete, or modify search queries and campaigns<br />- Update custom tags for messages, reported incidents, and uploaded files<br />- Upload a file for analysis                                                                     |
| User (Tenant-Restricted)          | `xcc_tenant_analyst`       | This user can only access resources on their own tenant and can:<br />- Release emails from quarantine<br />- Reanalyze/Unlock emails<br />- Send feedback for reported incidents<br />- Submit misclassification reports<br />- View campaigns and saved searches (no modifications)<br />- Update custom tags for messages, reported incidents, and uploaded files<br />- Upload a file for analysis |
| Auditing User                     | `xcc_analyst_audit`        | - View messages, reported cases, and analyzed files<br />- View campaigns and saved searches<br />- View the custom tags of messages<br />- View items from black- and whitelists in the web interface<br />- View configuration lists in Expert Editor                                                                                                                                                |
| Auditing User (Tenant-Restricted) | `xcc_tenant_analyst_audit` | This user can only access resources on their own tenant and can: <br />- View messages, reported cases, and analyzed files<br />- View campaigns and saved searches<br />- View the custom tags of messages<br />- View items from black- and whitelists in the web interface<br />- View configuration lists in Expert Editor                                                                         |
| Admin                             | `xcc_admin`                | - Isolate messages from user mailboxes<br />- Modify black- and whitelists in the web interface<br />- Edit configuration lists in Expert Editor<br />- Start a new backup and check the status of the running process<br />- Edit system configurations<br />- Other power user capabilities                                                                                                          |
| Auditing Admin                    | `xcc_admin_audit`          | - Everything that an `Auditing User` can view<br />- View system configurations and backup status                                                                                                                                                                                                                                                                                                      |
| Self-Service Quarantine User      | `xcc_quarantine_user`      | - Authenticate and log in via the web interface<br />- Change basic settings such as white/black theme<br />- View emails in the `Malware`, `Extortion`, `Policy` and `Impersonation` quarantine<br />- View and release emails from the `Phishing` and `Spam` quarantine.                                                                                                                             |
| Insights User                     | `xcc_insights`             | Access to the statistics dashboards in the **Insights** section                                                                                                                                                                                                                                                                                                                                        |
| Monitoring User                   | `xcc_monitor`              | Access to `/monitoring` (Grafana)                                                                                                                                                                                                                                                                                                                                                                      |

## Multi-Tenancy

The two tenant-restricted roles, `xcc_tenant_analyst` and `xcc_tenant_analyst_audit`, exist for multi-tenant deployments. A user with one of these roles only sees the resources of the tenant they are assigned to.

The tenant assignment does not come from the role itself: it comes from the `tenant` attribute your authentication backend maps for the user, which must match the `name` of a tenant in `guarded_tenants.yml`. See [Enable Tenant Login](/latest/multi-tenancy-authentication) for the mapping in SAML, LDAP and password file backends.