Certificate Hub provides the following role operations to grant permissions to users. 

• Browsing roles
• Creating a role
• Editing a role
• Deleting roles

An administrator can have no assigned roles as well. However, in such cases, the administrator can still exercise some capabilities in Certificate Hub, like:

• Browse imported and discovered Certificates.
• Audit Log.
• Manage owned Sources, Destinations, and Reports.
• Create Certificate Access Tags.

Administrators can hold more than one role. For instance, they might have permission to manage two, but not all, of the organization's CAs, and therefore hold two roles, one for each of the two CAs.