---
title: "User and Role Management"
description: "Standard roles, how to assign them, and the rules that govern privileged access."
source: "https://help.rikaiso.com/2026.1/users-and-roles"
version: "2026.1"
latest: true
language: "en"
section: "Administration"
updated: "2026-09-27"
---

# User and Role Management

> Standard roles, how to assign them, and the rules that govern privileged access.

## Standard roles

| Role | Purpose | Can grant roles |
| --- | --- | --- |
| `admin` | Full tenant administration | Yes |
| `editor` | Create and publish content | No |
| `analyst` | Read data and build reports | No |
| `user` | Day-to-day application access | No |

Roles are additive. A user with `editor` and `analyst` has the union of both permission sets.

## Assigning a role

1. Open **Administration → Users**.
2. Search for the user by email address.
3. Select **Manage roles**, tick the roles to grant, and confirm.
4. The change takes effect on the user's next request; active sessions are re-evaluated within 60 seconds.

## Invitations

Users who have never signed in are invited rather than created. An invitation carries the intended roles, expires after 15 days, and can be revoked before it is accepted.

## Rules

- A tenant must keep at least two accounts with the `admin` role.
- Roles are never stored on the user profile record; they live in a dedicated assignment table and are evaluated server-side on every request.
- Privileged role changes require the acting administrator to have signed in within the last 12 hours.

> Removing the last `editor` does not delete content. Published content stays online; only editing is blocked until a new editor is assigned.