Roles
Shows the role assignments given in this Tenant's own scope and which keys the five role archetypes grant here. Roles are given and revoked here.
For: Tenant administrator
What's on this screen
- On the left, Roles in this tenant: the five archetypes and the roles the platform or this Tenant's Account defined, each with how many assignments it has here. Choose one to open it on the right with the keys it grants and Who was given it in this tenant; the address keeps the choice (
?open=<key>). - With no role chosen, the right side shows Assignments given in this tenant: the person, the role, how many keys the role grants (and how many of them write), and since when the assignment has stood. If an assignment is already covered by another role, or is privileged with an unclear source, the row is marked with a badge.
- For an archetype (Administrator, Developer, Operator, Member and Auditor) the opened role says whether it can be held in this Tenant, the keys it grants, their risk classes and which of them write.
- The Give a role in this tenant form.
The page is Roles in the menu and follows the scope switcher: in a Tenant it shows that Tenant; at an Account or the platform it shows theirs.
Giving and revoking a role
- Choose the archetype from the Role list. The list contains only the archetypes that can be held in this Tenant.
- Enter the person's email. The person must be a member of this Tenant; otherwise the action is rejected with "This email isn't a member of this tenant".
- Press Give a role in this tenant. If the person already holds this role, no new assignment is created, and you are told so.
To remove an assignment, press Revoke on the row and confirm. The confirmation window tells you how many keys the assignment will drop. A revoked assignment isn't kept as history; it is deleted.
Good to know
Keep in mind This list isn't all of the access in the Tenant. A role given at Account or Platform level also works in this Tenant, but it doesn't appear here and can't be revoked from here. The full picture is on the Access screen.
- Who gave an assignment isn't recorded in the product, so no row shows a source.
- The Member archetype can be held only in the Tenant scope, so it can be given here but not on the Account screen.
- An archetype that grants no keys is a draft: even if held, it authorises nothing.
Tip Seeing the screen needs role.read in this Tenant; giving and revoking roles need role.write. Making someone a member is a separate task (membership.write) and is done on the Members screen.