diff --git a/app/models/role.rb b/app/models/role.rb
index 7262bb982..475a62c65 100644
--- a/app/models/role.rb
+++ b/app/models/role.rb
@@ -1,4 +1,11 @@
 class Role < ApplicationRecord
+  ROLES = [
+    :administrator,   # Can do everything
+    :editor,          # Can edit any models
+    :contributor,     # Can upload models and edit their own
+    :viewer           # Can view models; read only access
+  ]
+
   has_many :users, through: :users_roles
 
   belongs_to :resource,
@@ -9,5 +16,8 @@ class Role < ApplicationRecord
     inclusion: {in: Rolify.resource_types},
     allow_nil: true
 
+  validates :name,
+    inclusion: {in: ROLES.map(&:to_s)}
+
   scopify
 end
diff --git a/spec/models/role_spec.rb b/spec/models/role_spec.rb
index d50be5c51..721200e15 100644
--- a/spec/models/role_spec.rb
+++ b/spec/models/role_spec.rb
@@ -7,4 +7,9 @@ RSpec.describe Role do
     user.add_role :administrator
     expect(user.is_administrator?).to be true
   end
+
+  it "must be from the allowed list" do # rubocop:disable RSpec/MultipleExpectations
+    expect { user.add_role :batman }.to raise_error(ActiveRecord::RecordInvalid)
+    expect(user.is_batman?).to be false
+  end
 end