Overview

You can relate different roles to different users to let them have certain permissions for the bastion host.

In a bastion host, only admin has the permission to customize roles and modify permissions for roles.

In a bastion host, default roles include DepartmentManager, PolicyManager, AuditManager, and User. The default roles cannot be deleted, but you can change the permissions of the default roles.

**Table 1** Default roles
Parameter	Description
DepartmentManager	Specifies the operation administrator of the department, who manages the bastion host system. DepartmentManager has the configuration permissions for all other modules except User and Role modules.
PolicyManager	Specifies the user permission policy administrator. This role manages host operation permissions. It has the permissions for configuration of the user management, resource group management, and access policy management modules.
AuditManager	Specifies the O&M result audit administrator. This role queries and manages system audit data. This role has the configuration permissions for real-time session, historical session, and system logs modules.
User	Specifies common users and operators. This role has the permissions for O&M of resources, such as host and application resources, and service ticket authorization management.