Identity & Access
In one place you see who is registered on the platform, which role they hold in which scope, the status of invites, and identity matches awaiting a decision.
What's on this screen
- On the left, People: every user on the platform, with how many roles they hold; people with no role read No role, those who have not verified their email Unverified email. Choose one to open them on the right with their join date and every role they hold, in which scope; the address keeps the choice (
?open=). - With no one chosen, the right side shows the counts and the sections below.
- Invites: every invite sent, which Tenant and role it was for, its last day or acceptance date.
- Identity matching queue: pairs of records thought to be the same entity, with a confidence percentage.
- Matching rule sets and resolution decisions: a read-only summary.
Invite statuses
| Label | Meaning |
|---|---|
| pending | The invite is open and its last day has not passed. |
| past due | The last day has passed but the record still says pending; the screen shows it this way by looking at the clock, and does not write it to the record. |
| accepted | The person accepted the invite. |
| revoked | The invite was cancelled. |
| expired | Marked as expired in the record. |
Deciding on a match
- Find the pair in the queue; the IDs of the two records are shown side by side.
- In the Decision field, choose Keep separate, Link as the same entity or Merge.
- If you are merging, choose which record stays in the Surviving record field. This field is enabled only for a merge.
- Press Apply decision.
Keep in mind A decision cannot be undone, and the same pair never enters the queue again — Keep separate included. If someone else decided on the pair before you, the screen shows this as an error.
Rule sets and resolution decisions cannot be written from this screen; the product has no action that writes them. If a record is inconsistent, the row shows not serving and a reason code.
Who can see what
Opening the screen requires membership.read on the platform. The role column also needs role.read; without it you still see the people, with a note in place of the roles. Seeing the queue requires record.read, deciding requires record.write.