> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.
# raff role
> Manage IAM roles from the CLI — list system + custom roles, create custom roles with a permission set, update, delete. System roles (Owner, Admin, etc.) are immutable.
Updated May 10, 2026
The `raff role` command group manages IAM roles. **System roles** (Owner, Admin, Operator, Member, etc.) are immutable and managed by the platform; only **custom roles** can be created here. Every subcommand supports `--output json` for scripting. Alias: `raff roles`.
## Subcommand index
| Subcommand | What it does |
| ------------------- | ------------------------- |
| [`list`](#list) | List roles |
| [`get`](#get) | Show details for one role |
| [`create`](#create) | Create a custom role |
| [`update`](#update) | Update a custom role |
| [`delete`](#delete) | Delete a custom role |
***
## list
```bash theme={null}
raff role list [--scope account|project] [--output table|json]
```
List roles, optionally filtered by scope. Output columns: `ID`, `NAME`, `SLUG`, `SCOPE`, `SYSTEM`, `PERMISSIONS` (count).
## get
```bash theme={null}
raff role get
```
Show full role details — name, slug, scope, system flag, description, full permission list.
## create
```bash theme={null}
raff role create \
--name \
--slug \
--scope account|project \
--permission [--permission ...] \
[--description ]
```
Create a custom role. Required: `--name`, `--slug`, `--scope`, at least one `--permission`. Pass `--permission` multiple times to add several permissions. Discover permission names via [`raff permission list --scope `](/reference/cli/permission#list).
```bash theme={null}
# Account-scoped read-only role
raff role create --name "Auditor" --slug auditor --scope account \
--permission account.audit.read \
--permission billing.read \
--description "Read-only access for compliance"
# Project-scoped VM operator
raff role create --name "VM Operator" --slug vm-operator --scope project \
--permission vm.read --permission vm.power
```
## update
```bash theme={null}
raff role update \
[--name ] \
[--description ] \
[--permission ]...
```
Update a custom role. At least one flag must be provided. Passing `--permission` replaces the entire permission set; omit to keep current permissions.
## delete
```bash theme={null}
raff role delete [--force]
```
Delete a custom role. System roles cannot be deleted. Pass `--force` to skip the confirmation prompt.
## Related
Browse the permission catalog.
Declarative role management.
Assign roles to members.