User and Role Management
Standard roles, how to assign them, and the rules that govern privileged access.
Standard roles#
| Role | Purpose | Can grant roles |
|---|---|---|
admin | Full tenant administration | Yes |
editor | Create and publish content | No |
analyst | Read data and build reports | No |
user | Day-to-day application access | No |
Roles are additive. A user with editor and analyst has the union of both permission sets.
Assigning a role#
- Open Administration → Users.
- Search for the user by email address.
- Select Manage roles, tick the roles to grant, and confirm.
- The change takes effect on the user's next request; active sessions are re-evaluated within 60 seconds.
Invitations#
Users who have never signed in are invited rather than created. An invitation carries the intended roles, expires after 15 days, and can be revoked before it is accepted.
Rules#
- A tenant must keep at least two accounts with the
adminrole. - Roles are never stored on the user profile record; they live in a dedicated assignment table and are evaluated server-side on every request.
- Privileged role changes require the acting administrator to have signed in within the last 12 hours.
Removing the last
editordoes not delete content. Published content stays online; only editing is blocked until a new editor is assigned.
Last updated: