Create a custom role

Make a role with exactly the permissions a job needs, then edit or delete it.

In short

When no built-in role fits a job, make a role of your own with exactly the permissions it needs. It appears in every role picker and describes itself in plain words. You can change or delete it later, and every change shows what it does first.

Before you start

Who: "Create and change roles". You can create or change a role only with permissions you hold yourself.
Plan: Organizations is part of every plan, Free included. Your plan sets how many members and teams an organization may hold (Plan & usage shows them).
First: decide the job the role does and the least permissions it needs.

Steps

Open the organization's "Access" › "Roles" and choose "New role".
Type a name of 2 to 120 characters. A name that matches a built-in role is refused.
Choose what it may do: the permissions in their groups, each with a line of help, and how far it reaches in each module - None, View, Edit or Manage.
Choose "Create role".

Choose "Edit" on the role.
Make the change, then read "Review the change": who and what it reaches, what it adds and takes away, and what it costs or frees in seats.
Choose "Save role". It applies to everyone who holds it at once; a paid seat it adds is confirmed first.

Result: the role appears in every role picker, described as what it can do.

Example Take a QA Engineer role with Use API Tester, Use UI Tester, Review API verification and Change cards. Every picker describes it as: A role of this organization that can: Use API Tester, Use UI Tester, Review API verification and Change cards.

Good to know

You need Create and change roles. You can create or change a role only with permissions you hold yourself; a permission you lack says "You do not hold this".
A role that can do things you cannot is changed only by someone who can do all of it.
The role newcomers get cannot carry a dangerous permission.
Deleting a role cannot be undone; nobody loses their membership.

Some roles are as strong as Organization Admin A role with a dangerous permission - Invite and manage members, Create and change roles, Open anything with Manage all - can change membership or access as freely as an administrator. Everyone who manages roles, and the owner, is told once people hold such a role.

If something goes wrong

The name is refused: it matches a built-in role, or is shorter than 2 or longer than 120 characters.
A change is refused because it would leave nobody able to do something, such as manage roles. Give that permission to another role first.
Delete is refused while something still gives or names the role - members, invitations, join links or single sign-on lines. Give them another role first.