# Roles & Rights: Why does somebody who just wants to create segments need the right to edit the website via Tag Manager or change the whole Site settings? **URL:** \ **Category:** Request a feature & Roadmap\ **Created:** [June 20, 2024, 12:11pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147 "2024-06-20T12:11:19Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![loldenburg](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/loldenburg/32/965_2.png) [@loldenburg](https://community.piwik.pro/u/loldenburg)\ **Post date:** [June 20, 2024, 12:11pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147/1 "2024-06-20T12:11:20Z")
I am diving deeper into the Roles & Rights of a site that uses PP Tag Manager and Analytics. And I am puzzled… Examples: 1. The “Edit” right is needed to give somebody the right to create a Custom Report. But the same right also gives the person the right to change everything in Tag Manager! Why are rights for the Tag Manager and Analytics in the same roles bucket? 2. If you want somebody to create a harmless segment or calc metric in PP, that person needs the Edit & Publish role. But that same right allows them to change and even Publish stuff in Tag Manager AND they can also completely edit (and destroy your Site Settings, e.g. toggle scroll depth tracking on without anybody noticing and thus increase your Events and bill manifold), change Session Settings, Privacy Settings (deactivate Consent Manager) etc… > **[Permissions for a site or app | Piwik PRO help center](https://help.piwik.pro/support/account/site-app-permissions/)** > > If you’re going to use Piwik PRO in your team, you need to create a user account for each teammate and assign them permissions to sites and apps. You can also create groups and assign permissions to them. In this article, we’ll go over permission... ---
**Author:** ![loldenburg](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/loldenburg/32/965_2.png) [@loldenburg](https://community.piwik.pro/u/loldenburg)\ **Post date:** [June 20, 2024, 12:25pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147/2 "2024-06-20T12:25:44Z")
The easiest quick-fix would be to allow people with “View” rights to at least create Custom Reports (but not share them with All). No harm can be done by creating a Custom Report. But with Tag Manager or Consent Manager, I can kill the website or destroy the whole tracking… ---
**Author:** ![rmastop](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/rmastop/32/29_2.png) [@rmastop](https://community.piwik.pro/u/rmastop)\ **Post date:** [June 20, 2024, 12:29pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147/3 "2024-06-20T12:29:29Z")
Hi @loldenburg, Let me try to help you here, because it is not as straightforward is you put it here. Usually the roles of the ppl you add to the Platform are either Technical or not that technical. A not technical person doesn’t need to have access to, for instance, the Tag Manager. Therefore we have the option to enable / disable modules for every account you add to the instance, as seen here: > **[Permissions for modules | Piwik PRO help center](https://help.piwik.pro/support/account/permissions-for-modules/#change-access-to-modules)** > > When you add a new teammate to your account, they’ll automatically have access to all modules, including Analytics, Tag Manager, Consent Manager, Customer Data Platform and Administration. However, you can easily change their access by limiting their... Did you notice that? Because in many cases that’s the key for user management. kind regards, Richard ---
**Author:** ![loldenburg](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/loldenburg/32/965_2.png) [@loldenburg](https://community.piwik.pro/u/loldenburg)\ **Post date:** [June 20, 2024, 12:48pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147/4 "2024-06-20T12:48:51Z")
Ah ok, I must have forgotten about that. Very confusing. That should be in the same place as rights & roles. To change a user’s permission, I now have to go to 2 places for everyone. Still, somebody with Analytics access should be able to create segments without giving them the right to change the whole site settings… ---
**Author:** ![rmastop](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/rmastop/32/29_2.png) [@rmastop](https://community.piwik.pro/u/rmastop)\ **Post date:** [June 20, 2024, 1:14pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147/5 "2024-06-20T13:14:18Z")
Yeah, I know. So many things to do, so little time… You must know the feeling 😁 Truth is, it will not be changed in the near future, because there are more important and impactful task waiting to be completed. Good thing you created a topic that will draw ppl to the explanation in case they have similar questions. User management can never be detailed enough, thanks for pointing us to the details where the most confusion is about. It helps our team to improve it. Cheers, Richard. ---
**Author:** ![loldenburg](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/loldenburg/32/965_2.png) [@loldenburg](https://community.piwik.pro/u/loldenburg)\ **Post date:** [June 20, 2024, 1:25pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147/7 "2024-06-20T13:25:31Z")
Apart from that, it seems impossible to see which group a user is part of. I have to go into each group and check the whole list. Or am I missing sth again? ---
**Author:** ![rmastop](https://dub1.discourse-cdn.com/flex005/user_avatar/community.piwik.pro/rmastop/32/29_2.png) [@rmastop](https://community.piwik.pro/u/rmastop)\ **Post date:** [June 20, 2024, 1:31pm UTC](https://community.piwik.pro/t/roles-rights-why-does-somebody-who-just-wants-to-create-segments-need-the-right-to-edit-the-website-via-tag-manager-or-change-the-whole-site-settings/4147/8 "2024-06-20T13:31:58Z")
Yes, you can check the ppl that are part of the group, not the other way around, you are correct. Those users can have individual access to the different modules, so a user, having edit rights, can have access to either TM or Analytics, or both. It is on the wish list as well.