# Roles in your app

Theorem decides who gets your app at all. What each of those people may do inside it is
yours to decide, from the token's `team` claim ([The token](/developers/token)).

## What you can rely on

| You want to know | Read |
|---|---|
| Who the person is | `sub`, which never changes. Not `email` or `name`, which can. |
| Whether they lead the team | `team.leader` |
| Whether they hold a role | `team.roles`, by `id` |
| The team | `team.id` |

Every token your app accepts is for your own team, because you checked `aud`. So
`team.id` is always the same for your app.

## Roles by ID or by name

A role has an ID, `rol_` and 26 letters and digits, and a name a leader makes up. The ID
stays when a leader renames the role. The name does not.

- **By ID** is safest: a rename changes nothing. Keep the IDs your app trusts in its own
  settings, read from a token of someone who holds the role.
- **By name** is simpler and reads well, as in the example's Finance. It stops matching if
  a leader renames the role, and matches again if someone makes a new role with that name.

The example's `team_hours` checks by name: it answers when `team.leader` is `true` or a role
in `team.roles` is named Finance ([Quick start](/developers/quick-start)).

## Refusing inside a tool

When a person may use your app but not one of its tools, answer the call with words that
say why, as `team_hours` does. The assistant reads them and tells the person. Answer 401 only
for a token that fails its checks: it reads as your app refusing Theorem's token.

## Who gets the app

The leader chooses on the **Connections** tab: everyone in the team, or the holders of
chosen roles ([Your team's connections](/teams/connections)). That is the first gate.
Your rules inside the app are the second. A leader can check your app even when they don't
get it, so a token may come from a leader who holds none of the app's roles: decide what a
leader may do with that in mind.

## Changes

Roles in a token are as they were when it was signed. A role given or taken away shows in
the person's next token, within five minutes.