How do I assign multiple roles to a user in REDCap?
REDCap’s built-in user permissions allows for users to have access to one or more Data Access Group (DAG) but only one User Role. The REDCap Role Switcher external module adds the ability to define multiple User Role assignments to an individual user.
This external module can only be requested by users in a project with Project Design and Setup user rights.
To start configuring users in the Role Switcher:
Add the user to the REDCap project as normal.
Access the Role Switcher configuration page, User Role Assignments.
The “User Role Assignments” link is available only to REDCap users authorized to manage database user rights.
Select the roles that the user can switch between. (See important note, below.)
Define the DAGs the user can access when acting in each role.
WARNING: The Role Switcher is a secondary User Rights interface that may not align with primary settings. When updating the Role Switcher, also update the standard User Rights and DAG assignments for the user. For example, removing the Clinical Research Coordinator role only from the Role Switcher does not immediately revoke that access.
If the user was previously in a Clinical Research Coordinator role, then the standard User Rights also need to be updated to reflect the change.
🚨 Important – Role Access and Site Authorization 🚨
The ability to switch between roles in REDCap does not grant users unrestricted access to data across sites or functional areas.
All access — including the ability to view, enter, or modify data — must be consistent with the individual’s documented responsibilities as defined by the study protocol, informed consent, and the site’s Delegation of Authority (DoA) log (or equivalent authorization documentation).
Users at a “managing” or coordinating site do not inherently have permission to access or modify data for other participating sites unless such access is explicitly documented and authorized.
Project administrators are responsible for ensuring that assigned roles (and any role-switching capabilities) reflect only those permissions that have been formally delegated. Assigning broader access than documented may introduce compliance risks and compromise audit traceability.