Access
Shows who can actually do what in this Tenant: person by person, which keys apply, which role and which scope each key comes from, and which capabilities and workspaces this access reaches.
For: Tenant administrator, Auditor
What's on this screen
- Two numbers at the top: the number of people with keys here and the number of members with no keys at all; below them, the scope chain that was read (Tenant ← Account ← Platform).
- Who can do what here: the person with the most write keys is at the top. Opening a person shows the roles they hold, each key and the key's source.
- Member, but no keys: people who are members of the Tenant but have no role.
- The Which capabilities this access reaches and which workspaces it reaches sections.
What it means
| Marker | Meaning |
|---|---|
| writes | The key does more than read. |
| inherited / (from above) | The key comes not from a role given in this Tenant, but from a role given in the Account or Platform. That is also where it has to be revoked. |
| Risk badge | Critical, High, Medium, Low: the key's risk class. The person's row shows the highest. |
| Managed workspace | Everyone holding workspace.read in this Tenant can enter. |
| Shared workspace | The owner and individually added people can enter; the role doesn't change this. |
| Private workspace | Only the owner can enter; no role opens it. |
Keys ending in purge aren't inherited from above; they apply only when given in the scope that owns the data. That is why someone holding purge in the Account doesn't carry it here.
Capabilities aren't given to people one by one; the product has no such record. Everyone holding capability.read sees every capability turned on in this Tenant, and everyone holding capability.write changes them. The section names these people.
Good to know
Keep in mind This screen only shows; nothing can be changed. If a link in the chain can't be read, the screen says so: the keys coming from that scope aren't in the list, meaning the list is incomplete, not empty.
Tip Seeing it needs membership.read in this Tenant. The capabilities section needs capability.read and the workspaces section needs workspace.read; if you don't have the permission, that section states the missing permission instead of showing an empty list.
To drop a key or give a role, go to the Roles screen; for a role that comes from above, you need the Account's roles screen.