# Clerk org creator and default roles

Two role assignments are sticky: the Creator Role (given to whoever creates
an org) and the Default Role (given to new members, including verified-domain
enrollment and invitation pre-fills). You cannot delete a role while it holds
either assignment.

## Set the creator role on purpose

1. In the dashboard open Roles and Permissions and pick the role set.
2. The new role must have at least the manage members, read members, and
   delete organization system permissions, or it cannot serve as creator.
3. Open the three-dot menu on the role and pick Set as creator role.
4. Only then delete or repurpose the old admin role. Trying it in the reverse
   order errors out.

## Set the default role on purpose

1. Same page, three-dot menu on the intended role, pick Set as default role.
2. Every new member lands here: invitations pre-fill it, verified-domain
   auto-enrollment uses it. If your default is admin by accident, every invite
   is a privilege escalation.
3. You cannot delete a role while it is the default either. Reassign first.

## Checklist

- Before deleting any role: confirm it is not the creator role, not the
  default role, and not assigned to any member. All three block deletion.
- The org creator is automatically the first member with the creator role.
  If your onboarding creates orgs on behalf of users via the backend API,
  the created_by user still gets the creator role, so build from a service
  context and fix up membership right after if needed.