Central Team Roles allow administrators to assign workspace, folder, and subfolder level roles directly to an entire Central Team rather than managing individual users.

When a role is assigned to a Central Team, all active members of that team automatically inherit the role's permissions. When users join or leave the team, their access updates immediately without requiring manual role adjustments.

Requirements and Prerequisites

Please ensure you have read the below prerequisites before configuring Central Team Roles to ensure the following requirements are met:

Central Team Roles is only available upon Request. Contact your Cutover Customer Success Manager to enable the feature for your instance.
Central Team assignment can only be enabled for Workspace and Folder role types. It is not supported for global system roles.
Each role type has to be enabled individually to make it available for central team assignment. So please ensure you provide the full list of role types you would like to make available when speaking to your Cutover Success Manager.

see the Role and permission article for our available roles.

How to Assign a Role to a Central Team

Once you have the feature enabled and made role types available for assignment, here is how you would assign the roles to a Central team.

Note: for Role Assignment Permissions you’ll need the following permission:

Workspace level: Requires Workspace Manager permissions.
Folder level: Requires Folder Admin / Manager permissions.
Subfolder level: Requires Subfolder Admin / Manager permissions.

At the Workspace Level

Go to Settings (Cog icon at the bottom of the blue navigation bar on the left hand side). And then the Workspace section
Click on the workspace and it should open the Edit Workspace panel on the right hand side.
Locate the role field you want to assign (e.g., Stakeholder, Template Reviewer).
Type the name of the Central Team in the role field.
Select the team from the dropdown list.
Select Save Changes.

At the Folder or Subfolder Level

Navigate to the folder or subfolder.
Open the Folder Edit or Subfolder Edit panel.
Locate the role field you want to assign andType the name of the Central Team and select it from the dropdown list.
Select Save Changes.

Remove a Role from a Central Team

Navigate to the Edit Workspace or Folder/Subfolder Edit panel where the role is assigned.
Locate the relevant role field and find the team name pill.
Select the X icon next to the team name to remove the assignment.
Select Save Changes.

Viewing Inherited Roles

In the User Details Panel

Administrators can check which roles an individual user inherits through their Central Team memberships:

Navigate to Access management in Settings
Select a user to open their User Details panel.
Locate the Central Teams section directly below the Roles section.

How to Review the read-only tree structure:
- Workspace → Central Team → Assigned Roles.
- Folder-level roles are grouped under their role type. Subfolder roles display their parent path (e.g., Parent Folder/Subfolder).

Display Rules:

The Central Teams section only appears if the user is an active member of at least one active Central Team.
It only displays teams within workspaces that the viewing administrator has permission to see.
It omits expired or archived roles, disabled role types, and roles on hidden or archived folders.

In the Central Team Details Panel

Navigate to Workspace > Central Teams and select a team.
Go to the Roles section in the Edit team panel, it should list all workspace, folder, and subfolder roles held by that team.
Subfolder roles display alongside their parent folder to distinguish between subfolders with identical names.

Important considerations

How Central Team Roles Affect RBAC Role Purge

Role Purge only cleans up roles assigned directly to individual users. It does not remove roles inherited through a Central Team.

If a user belongs to a Central Team that has been assigned a role, they will keep those team permissions every time they log in, even if their direct access is removed via RBAC.

What is RBAC role purge?

Central Team Roles, RBAC, and Role Purge

When your organization uses SAML Single Sign-On (SSO) and Role-Based Access Control (RBAC), your identity provider acts as the "single source of truth" for user permissions.

To keep access aligned with your RBAC system, Cutover offers a setting called Role Purge. However, roles assigned through Central Teams work differently than direct user roles. Here is what you need to know about how they interact.

What is Role Purge?

Role Purge automatically removes any role assigned directly to a user inside Cutover if that role is not also listed in their SAML/RBAC profile. This cleanup happens every time the user logs in, ensuring manual changes in Cutover never override your central security rules.

Key Things to Keep in Mind

Team roles stay active across logins: Because SAML cannot remove Central Team roles, a user can retain capabilities granted by the central team even if their direct access changes in RBAC. (For example: If a user loses their direct Workspace Member role in RBAC, they can still review templates if they belong to a Central Team with the Template Reviewer role).
Adding users to Central teams grants access: Anyone with permission to add users to a Central Team automatically grants them that Central team's roles.
Checking user permissions: Central team inherited roles do not appear under a user's standard Roles list. To see the full picture of what a user can do, check the Central Teams section in their User Details panel. (Note: For roles like Template Reviewer, you still cannot select the user individually, but they can perform the review as part of their assigned team).

How It Works: Examples table

Level	RBAC Role	Manual Direct Role	Central Team Role	Result After Next Login
Workspace	Workspace Member (Purge Role ON)	Runbook Creator	Stakeholder	Runbook Creator is removed. Stakeholder access remains as long as they stay on the team.
Folder	Folder Member (Purge Role ON)	Runbook Creator	Stakeholder	Runbook Creator is removed. Stakeholder access remains as long as they stay on the team.

The exact same behavior applies at the Subfolder level.

Built-in Safeguards

To help you manage Central Team access safely alongside RBAC, Cutover includes the following controls:

Opt-In Role Permissions: Roles cannot be assigned to Central Teams by default. An administrator must explicitly enable Allow assignment to central teams for a specific role type before it can be used this way.
Restricted Assignment Rights: Only designated managers can assign roles to a Central Team at their respective level (Workspace Managers at the workspace level, Folder Managers at the folder level, and Subfolder Managers at the subfolder level).
Clear Visibility on User Profiles: The Central Teams section in the User Details panel displays all team-inherited roles right alongside a user's direct roles.
Audit Logging: The Central Team audit log records whenever a role is assigned to a team, as well as whenever an admin manually adds or removes a user from that team.

Note: If you use an automated integration to sync Central Team memberships, those automated user additions and removals are tracked in your source system rather than the Cutover audit log).