diff --git a/config.jsonc b/config.jsonc
index 7d128b6..5442802 100644
--- a/config.jsonc
+++ b/config.jsonc
@@ -38,9 +38,9 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
         texts of a rights level up to and including x
     */
     "capabilities": {
-        "canAddItems": {"member": true, "staff": true, "admin": true},
-        "canAddDocuments": {"member": true, "staff": true, "admin": true},
-        "canDownloadVideo": {"guest": 0, "member": 0, "staff": 1, "admin": 1},
+        "canAddItems": {"staff": true, "admin": true},
+        "canAddDocuments": {"staff": true, "admin": true},
+        "canDownloadVideo": {"guest": 0, "member": 0, "visitor": 0, "staff": 1, "admin": 1},
         "canEditAnnotations": {"staff": true, "admin": true},
         "canEditDocuments": {"staff": true, "admin": true},
         "canEditEntities": {"staff": true, "admin": true},
@@ -52,7 +52,7 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
         "canEditMedia": {"staff": true, "admin": true},
         "canEditMetadata": {"staff": true, "admin": true},
         "canEditPlaces": {"staff": true, "admin": true},
-        "canEditRightsLevel": {"member": true, "staff": true, "admin": true},
+        "canEditRightsLevel": {"member": false, "visitor": false, "staff": true, "admin": true},
         "canEditSitePages": {"staff": true, "admin": true},
         "canEditUsers": {"admin": true},
         "canExportAnnotations": {"member": true, "staff": true, "admin": true},
@@ -64,9 +64,9 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
         "canManagePlacesAndEvents": {"member": true, "staff": true, "admin": true},
         "canManageTitlesAndNames": {"member": true, "staff": true, "admin": true},
         "canManageUsers": {"staff": true, "admin": true},
-        "canPlayClips": {"guest": 0, "member": 0, "staff": 1, "admin": 1},
-        "canPlayVideo": {"guest": 0, "member": 0, "staff": 1, "admin": 1},
-        "canReadText": {"guest": 0, "member": 0, "staff": 1, "admin": 1},
+        "canPlayClips": {"guest": 0, "member": 0, "visitor": 0, "staff": 1, "admin": 1},
+        "canPlayVideo": {"guest": 0, "member": 0, "visitor": 0, "staff": 1, "admin": 1},
+        "canReadText": {"guest": 0, "member": 0, "visitor": 0, "staff": 1, "admin": 1},
         "canRemoveItems": {"admin": true},
         "canRemoveDocuments": {"admin": true},
         "canSeeAccessed": {"staff": true, "admin": true},
@@ -74,8 +74,8 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
         "canSeeDebugMenu": {"staff": true, "admin": true},
         "canSeeExtraItemViews": {"staff": true, "admin": true},
         "canSeeMedia": {"staff": true, "admin": true},
-        "canSeeDocument": {"guest": 0, "member": 0, "staff": 1, "admin": 1},
-        "canSeeItem": {"guest": 0, "member": 0, "staff": 1, "admin": 1},
+        "canSeeDocument": {"guest": 0, "member": 0, "visitor": 1, "staff": 1, "admin": 1},
+        "canSeeItem": {"guest": 0, "member": 0, "visitor": 1, "staff": 1, "admin": 1},
         "canSeeSize": {"staff": true, "admin": true},
         "canSeeSoftwareVersion": {"staff": true, "admin": true},
         "canSendMail": {"admin": true}
@@ -355,7 +355,7 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
     "documentRightsLevel" defines which initial rights level will be assigned to documents
     created by users of these user levels.
     */
-    "documentRightsLevel": {"member": 0, "staff": 0, "admin": 0},
+    "documentRightsLevel": {"member": 0, "visitor": 0, "staff": 0, "admin": 0},
     /*
     "documentRightsLevels" is an ordered list of rights levels, one of which will be
     assigned to each document.
@@ -1041,7 +1041,7 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
         {
             "id": "keywords",
             "title": "Keywords",
-            "canAddAnnotations": {"member": true, "staff": true, "admin": true},
+            "canAddAnnotations": {"member": false, "visitor": false, "staff": true, "admin": true},
             "item": "Keyword",
             "autocomplete": true,
             "overlap": true,
@@ -1052,7 +1052,7 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
         {
             "id": "notes",
             "title": "Notes",
-            "canAddAnnotations": {"member": true, "staff": true, "admin": true},
+            "canAddAnnotations": {"member": false, "visitor": false, "staff": true, "admin": true},
             "item": "Note",
             "overlap": true,
             "showInfo": true,
@@ -1061,7 +1061,7 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
         {
             "id": "internalnotes",
             "title": "Internal Notes",
-            "canAddAnnotations": {"member": true, "staff": true, "admin": true},
+            "canAddAnnotations": {"member": false, "visitor": false, "staff": true, "admin": true},
             "item": "Internal Note",
             "overlap": true,
             "showInfo": true,
@@ -1139,7 +1139,7 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
     "rightsLevel" defines which initial rights level will be assigned to items
     and texts created by users of these user levels.
     */
-    "rightsLevel": {"member": 1, "staff": 1, "admin": 1},
+    "rightsLevel": {"member": 1, "visitor": 1, "staff": 1, "admin": 1},
     /*
     "rightsLevels" is an ordered list of rights levels, one of which will be
     assigned to each item.
@@ -1408,7 +1408,7 @@ examples (config.SITENAME.jsonc) that are part of this pan.do/ra distribution.
     "userLevels" is an ordered list of user classes. The first entry is for
     unregistered visitors.
     */
-    "userLevels": ["guest", "member", "staff", "admin"],
+    "userLevels": ["guest", "member", "visitor", "staff", "admin"],
     /*
     "video" contains the video settings.
         "formats": Supported video formats.