##  Overview
The SAP LeanIX out-of-the-box Authorization model (part of the overall meta model) includes three default roles, VIEWER, MEMBER, and ADMIN. In general, these roles govern access to read (view), create (add), update (edit), and delete information at the Fact Sheet TYPE level. This "information" includes but is not limited to attributes, relations, and tags. This means that the Authorization Model is set and defined for the entire Fact Sheet TYPES, for example, IT Component. There are also some capabilities surrounding Import, Export, Saved Searches, and more.
Please see the [meta model](https://help.sap.com/docs/leanix/ea/meta-model?locale=en-US&state=PRODUCTION&version=CLOUD "Get an overview of the SAP LeanIX meta model and its key concepts.") for basic information on what a Fact Sheet TYPE is and what is the SAP LeanIX meta model.
You can request that these settings be different per role, VIEWER, MEMBER, and or ADMIN. In addition, you can also request that new roles be added to the authorization model; they would exist in addition to the standard roles.
The ability to configure the Authorization model is contingent upon the SAP LeanIX package that you have. As such, please discuss any authorization model changes that you are considering with your CSM, and they can inform you if your package covers authorization model changes. This document is not meant to be exhaustive in nature, as such, having a conversation with your CSM regarding your use case, especially if it's not covered in this document, could be very useful.
**Note**
Virtual Workspaces
If your organization is looking to control access at the level of individual Fact Sheets, your Use Case may be be accommodated by [Virtual Workspaces](https://help.sap.com/docs/leanix/ea/virtual-workspaces?locale=en-US&state=PRODUCTION&version=CLOUD "Manage access to fact sheets for custom user groups"). The standard authorization model cannot control access to individual Fact Sheets.
**Restriction**
New Authorization Model roles can only be created and utilized when your organization has your Identity Provider configured as external IdP. To learn more about setting up single sign-on (SSO), see [Single Sign-On (SSO)](https://help.sap.com/docs/leanix/ea/single-sign-on-sso?locale=en-US&state=PRODUCTION&version=CLOUD "Learn how to configure single sign-on \(SSO\) with SAP LeanIX.").
Any customer can request that the out-of-the-Box roles be updated (no new roles being created), this does not require a particular IP configuration (assuming that your package allows Authorization model changes).
