For the purpose of this guide, we will define an `editor-requester` role, which
can request the built-in `editor` role, and an `editor-reviewer` role that can
review requests for the `editor` role. 

Create a file called `editor-request-rbac.yaml` with the following content:

```yaml
kind: role
version: v5
metadata:
  name: editor-reviewer
spec:
  allow:
    review_requests:
      roles: ['editor']
---
kind: role
version: v5
metadata:
  name: editor-requester
spec:
  allow:
    request:
      roles: ['editor']
      thresholds:
        - approve: 1
          deny: 1
```

Create the roles you defined:

```code
$ tctl create -f editor-request-rbac.yaml
role 'editor-reviewer' has been created
role 'editor-requester' has been created
```

Allow yourself to review requests by users with the `editor-requester` role by
assigning yourself the `editor-reviewer` role. 

(!docs/pages/includes/add-role-to-user.mdx role="editor-reviewer"!)

Create a user called `myuser` who has the `editor-requester` role. This user
cannot edit your cluster configuration unless they request the `editor` role:

```code
$ tctl users add myuser --roles=editor-requester 
```

`tctl` will print an invitation URL to your terminal. Visit the URL and log in
as `myuser` for the first time, registering credentials as configured for your
Teleport cluster.

Later in this guide, you will have `myuser` request the `editor` role so you can
review the request using the Teleport plugin.