Inlorus
Screen guide

Roles

You see every role assignment inside this Account — in the Account itself and in its Tenants — and grant or revoke roles in the Account scope.

For: Account administrator

What's on this screen

  • On the left, Roles at this account: the five archetypes and the roles the platform or this Account defined, each with how many assignments it has inside the Account.
  • Choose a role to open it on the right: whether it can be held in this Account, the keys it grants, risk classes and writes / conditional markers, and Who holds it inside this account. The address keeps the choice (?open=<key>).
  • With no role chosen, the right side shows Assignments inside this account: person, role, in which scope (the Account or a Tenant), how many keys it grants and how many of them write, and since when it has been in place; then the grant form and Create a role.
  • Warnings on rows: privileged, unknown source or already covered by another role.
  • If a Tenant cannot be read, a separate Scopes that could not be read list.

The page is Roles in the menu and follows the scope switcher: while an Account is selected it shows that Account; at the platform it shows the platform's roles, in a Tenant that Tenant's.

Granting and revoking a role

  1. In the Grant a role in this account section, choose an archetype from the Role list. The list shows only roles that can be held in this Account; member is not included, because it can be held only in a Tenant.
  2. Type the person's email and press Grant a role in this account. If the person already holds this role, no new assignment is opened.
  3. To revoke, press Revoke on the row; the confirmation dialog says how many keys will be dropped.

Keep in mind A role can be granted only to someone who is already a member of a Tenant in this Account; for anyone else the screen says NOT_IN_ACCOUNT. A revoked assignment is deleted and not kept in history.

Limits and permissions

  • Seeing the page requires role.read in the Account; granting and revoking roles require role.write.
  • Only assignments in the Account's own scope are changed from here. Assignments in Tenants are read; you manage them on the Tenant's own Roles screen.
  • Making someone a member requires membership.write and is not done on this screen.
  • Who granted an assignment is not recorded in the product, so no row shows a source.