# Admin מול Moderator מול leader

**URL:** <https://meta.discourse.org/t/admin-vs-moderator-vs-leader/89008>\
**Category:** Product Support\
**Created:** [2 ביוני,‏ 2018,‏ 6:21pm UTC](https://meta.discourse.org/t/admin-vs-moderator-vs-leader/89008 "2018-06-02T18:21:58Z")\
**Posts on this page:** 1\
**Showing post:** 10

<div class="post-metadata">

**Author:** ![robmc](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/robmc/32/125900_2.png) [@robmc](https://meta.discourse.org/u/robmc)\
**Post date:** [12 ביוני,‏ 2018,‏ 12:55pm UTC](https://meta.discourse.org/t/admin-vs-moderator-vs-leader/89008/10 "2018-06-12T12:55:15Z")

</div>

> [@HAWK](#):
>
> The very high level answer is that TL4s can moderate content. Mods can moderate content and users.  
> TL4 has no visibility of flags etc.

Thanks for this. I knew a lot of this in principle, but it isn’t until you really put this into practice that you notice the issues and shortcomings.

Sadly, this is not delivering what I needed and I’m not sure if this is because I’m missing something, or whether I need to post something to #Contribute > Feature

It seems that ‘Moderators’ are a form of lesser-Admin. I understand that this is so that they can help to manage the content at a very high level (including the creation of categories and so on) and it is therefore assumed that they also need some user access.

However, in the post-GDPR world, in terms of data security and privacy, this poses a MAJOR issue. It means that any moderator can access the admin areas of the community and visit the user page and download the main database with personal information from the SSO process including names and email addresses. This is not acceptable.

We would therefore default to making our ‘citizen moderators’ TL4 users who can still modify content, but not access users or make structural changes. That is fine. However, it also means that they will never see flags either. Whilst certain serious issues, such as inappropriate behaviour, might require an admin’s view of the user’s history, that isn’t the case for notifications about broken links, incorrect categorisation, spam, etc.

Am I alone in feeling that we need something in-between, that gives broad access to content and flags, but withholding access to all user data?

Is there another way to achieve this?

---

_[View the full topic](https://meta.discourse.org/t/admin-vs-moderator-vs-leader/89008)._