Standard roles, how to assign them, and the rules that govern privileged access.
Standard roles
| Role | Purpose | Can grant roles |
|---|---|---|
admin | Full tenant administration | Yes |
editor | Create and publish content | No |
analyst | Read data and build reports | No |
user | Day-to-day application access | No |
Roles are additive. A user with editor and analyst has the union of both permission sets.
Assigning a role
- Open Administration → Users.
- Search for the user by email address.
- Select Manage roles, tick the roles to grant, and confirm.
- The change takes effect on the user's next request; active sessions are re-evaluated within 60 seconds.
Invitations
Users who have never signed in are invited rather than created. An invitation carries the intended roles, expires after 14 days, and can be revoked before it is accepted.
Rules
- A tenant must keep at least two accounts with the
adminrole. - Roles are never stored on the user profile record; they live in a dedicated assignment table and are evaluated server-side on every request.
- Privileged role changes require the acting administrator to have signed in within the last 12 hours.
Removing the last
editordoes not delete content. Published content stays online; only editing is blocked until a new editor is assigned.
Last updated: 2026-09-01