Roles and permissions

Understand the access model

Roles & permissions separates assignable roles from the permission catalog. A permission describes an authorized operation; a role groups permissions for an intended responsibility. The role's scope and tenant determine where that responsibility applies. Access to the screen does not itself authorize editing every role or assigning a role to every user.

Before changing a role, identify its intended users, the tenant concerned and the operations those users actually need. Review a current account in Users to understand its existing assignments. Use a laboratory role and identity to validate a proposed access arrangement before applying it more widely.

Inspect existing roles and permissions

1. Open Roles & permissions and select the Roles tab.
2. Search for a role, use table filters and open View details.
3. Review the role's key, label, scope, description and assignment information.
4. Select Permissions to inspect the permission catalog. Search for the relevant capability and open its details.
5. Use Columns and Export CSV where available to support a permitted review. Keep exported account and access information in an approved location.

The permission catalog is an inspection reference. Do not infer that a displayed permission is currently granted to the signed-in user or to the user being reviewed. Check the role assignment and its actual scope.

Create or edit a tenant role

1. Select New role, or Edit role on an editable role.
2. Enter a stable Key and a readable Label. Choose names that describe the responsibility without implying broader access.
3. Confirm Scope and Tenant before selecting permissions.
4. Enter a Description explaining when the role should be used.
5. Review the available permission choices and select the smallest set needed for the intended workflow.
6. Submit the form and verify the saved role in the table.
7. Open Users, assign the role to a synthetic laboratory account and verify both a permitted action and a relevant denied action.

System or immutable roles may be viewable without exposing edit or delete actions. Do not attempt to duplicate an immutable role merely to bypass that restriction. If a new responsibility is needed, create an appropriate editable tenant role through the supported form.

Remove a role safely

Delete role is available only for an eligible editable role. A role with assignments cannot be deleted through that action. First inspect the affected identities and decide which supported reassignment is appropriate. Reopen the role after those changes and verify its current assignment count before confirming deletion.

Acceptance and recovery

Successful access validation demonstrates the expected capability within the selected tenant and a denial outside its authorized scope. A button appearing in a menu is not sufficient evidence of authorization.

If a save is denied, verify the active role and workspace rather than changing tenants to evade the denial. If deletion is disabled, inspect assignments and immutability. After a change, refresh the relevant accounts and review Audit where appropriate.

Related guides: Users, Tenants and Authentication.