---
id: SCR-PFM-SEC-005
title: Roles list
route: /console/{tenantId}/security/roles
surface: console
product_area: platform
module: security
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
inference: []
source_sha:
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
purpose: Browse built-in and custom roles, with permitted copy, archive and creation actions.
supports:
- JNY-PFM-SEC-004
- CAP-PFM-SEC-012
permission: platform.security-roles.read
entry_from:
- /console/{tenantId}/security
exits_to:
- /console/{tenantId}/security/roles/{roleRef}
- /console/{tenantId}/security/roles/new
displays:
- field: Built-in/custom classification, status, holder summaries and the empty-authority indicator.
  source: listSecurityRoles (DOM-PFM-SEC-003 roles)
  provenance: observed
actions:
- label: New role
  operation_id: (navigates to new role)
  permission: platform.security-roles.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/roles-screen.tsx
- label: Duplicate
  operation_id: duplicateSecurityRole
  permission: platform.security-roles.manage
  confirm: false
  provenance: observed
  source: react-console:components/security/roles/roles-screen.tsx
- label: Archive
  operation_id: archiveSecurityRole
  permission: platform.security-roles.manage
  confirm: true
  provenance: observed
  source: react-console:components/security/roles/roles-screen.tsx
states:
- loading
- empty
- error
- read-only
validation:
- BR-CAP-PFM-SEC-012-08
- BR-CAP-PFM-SEC-012-09
- BR-CAP-PFM-SEC-012-14
patterns:
- SecurityPage guard
- PageHeader
- RoleActionsMenu
- NameDialog
- AsyncConfirmDialog
component: components/security/roles/roles-screen.tsx (RolesScreen)
evidence:
- 'react-console at baf6dae: components/security/roles/roles-screen.tsx; the page route file; lib/security/api.ts,
  lib/hq/platform-ops.ts, lib/hq/platform.ts, lib/auth/*'
- react-console:components/security/page-shell.tsx:SecurityPage; lib/authz/backend-aliases.ts (Security aliases)
console_area_permission: security.access
examined_at: '2026-10-23'
examiner: codex
controls: [TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Roles list

## What the Screen Is For

Browse built-in and custom roles, with permitted copy, archive and creation actions.

## What It Shows and Lets People Do

Role-reading authority admits the list, and management authority reveals creation, duplication and archive actions. Built-ins can be copied but not edited or archived by customer administration.

## States and Errors

The table distinguishes inactive or retired definitions and roles that add no authority. An archive blocked by use shows the relevant holder information. Loading, empty and failed reads follow the component’s list states.

The state rows describe observed loading, empty, refusal or inactive handling where present. Linked validation rules belong to the planning layer; client feedback and authoritative service checks have distinct responsibilities.

## Patterns It Must Respect

The pattern list names the built shared components and interaction patterns checked for this screen. This contract describes the existing screen; it supplies no replacement visual design.