Permissions resolve NTFS-style: the most specific scope (Step > Job > Folder > Server > Everywhere) that has any grant at all wins, and only within that scope does a Deny beat an Allow. Built-in roles: Viewer, Operator, Editor, Admin, and Fleet Admin (bypasses the permission system entirely). Settings -> My Permissions shows exactly why you do or don't have something.

See roles-and-permissions.md for the full technical story.

See also: Glossary for related terms.