Currently, custom roles can only be created by MSP admins in the Admin Dashboard. Tenant users, including Client Admins, cannot access the Admin Dashboard and therefore cannot create or manage their own custom roles.

For MSPs managing multiple customers, it would be very valuable to allow a trusted internal admin at the customer tenant to create and manage their own roles. This would enable better delegation and reduce MSP overhead while still keeping tenant-level permissions controlled.

A potential approach could be:

Allow a client admin to create and edit custom roles within their own tenant

Keep MSP-level controls as the outer policy boundary

Optionally allow MSPs to enable or disable this capability per tenant

This would help MSPs scale while giving customers more autonomy over their own user permissions.