---
title: "Enable Privilege Checking for a Role"
canonical: "https://docs.rubiconwater.com/space/UMNC/1983578186/Enable%20Privilege%20Checking%20for%20a%20Role"
format: markdown
---
You can specify whether sub-role privileges can be applied to a role by specifying whether privilege checking is enabled for the role on the **Role > Details** tab.

> ℹ️ **Note**
> ℹ️ 
> ℹ️ You CANNOT disable checking for the *Grant Authority* subrole privilege.

# Enable sub-role privilege checking:

**Step 1**

In the Roles module, select the role for which you want to configure privilege checking.

**Step 2**

On the Details tab, click **Edit** to enable editing.

**Step 3**

Select the privileges that you want to check. If checking is not enabled for a privilege, sub-role privileges are not checked when another user is making changes to the party details of a user with this role.

# Example

Suppose we have two roles: 

- OWNER has been assigned to a user whose details we want to edit.
- PLANNER is our role.

Suppose the PLANNER role has been assigned the “Edit user email address” privilege for the OWNER role. In this case, a PLANNER can change an email address for an SP OPERATOR whether or not *Include in Edit Email privilege check* is enabled for the OWNER role because, if a privilege check was performed, the check would pass.

Now suppose the PLANNER role has not been assigned any subrole privileges for the OWNER role. 

- If *Include in Edit Email privilege check* is enabled for OWNER, then PLANNERs **CANNOT** change an email address for an OWNER as the operation would fail the subrole privilege check.
- If *Include in Edit Email privilege check* is NOT enabled for OWNER, then Role B **CAN** change an email address for Role A because no privilege check would be performed before the change was made.

---