User and Role Management

Standard roles, how to assign them, and the rules that govern privileged access.

Standard roles#

Role	Purpose	Can grant roles
`admin`	Full tenant administration	Yes
`editor`	Create and publish content	No
`analyst`	Read data and build reports	No
`user`	Day-to-day application access	No

Roles are additive. A user with editor and analyst has the union of both permission sets.

Assigning a role#

Open Administration → Users.
Search for the user by email address.
Select Manage roles, tick the roles to grant, and confirm.
The change takes effect on the user's next request; active sessions are re-evaluated within 60 seconds.

Invitations#

Users who have never signed in are invited rather than created. An invitation carries the intended roles, expires after 14 days, and can be revoked before it is accepted.

Rules#

A tenant must keep at least two accounts with the admin role.
Roles are never stored on the user profile record; they live in a dedicated assignment table and are evaluated server-side on every request.
Privileged role changes require the acting administrator to have signed in within the last 12 hours.

Removing the last editor does not delete content. Published content stays online; only editing is blocked until a new editor is assigned.

Last updated: Sep 1, 2026