Skip to content

Users & Groups

1. Identity & Access

Identity & Access is the user management hub. Administrators can view all platform users, manage their roles and status, and invite new members to the tenant.

1.1 User Table

The user list displays all registered users with:

Column Description
Name Full name of the user
Email User's email address
Roles All roles assigned to the user (comma-separated)
Status ACTIVE, INACTIVE, or SUSPENDED
Date When the user account was created

Search is available by name or email address.

1.2 User Profile (Side Sheet)

Clicking a user opens their profile with: - Avatar initial, full name, and assigned roles - Email address - Roles displayed as individual color-coded tags - Member since date - Edit Permissions button — Opens the edit modal (see below) - Deactivate User button — Sets the user's status to inactive

1.3 Edit Permissions

The edit modal allows administrators to: - Change the user's status (active, inactive, suspended) - Toggle roles on or off via checkboxes. Available roles: - admin — Full platform access - approver — Can approve runtime reviews and policy endorsements - auditor — Read-only across all lanes - engineer — Can design agents, guards, and run simulations - viewer — Read-only access

1.4 Invite User

The Invite User button opens a modal to register a new user: - Name — Full name - Email — Email address (will receive invitation) - Roles — Initial role assignment via checkboxes

An invitation is sent to the specified email address, and the user appears in the list once they complete registration.

2. Group Management

Group Management allows administrators to organize users into named groups and assign bulk governance capabilities to the group, rather than configuring each user individually.

2.1 Groups Table

Each row shows: - Group Name - Members — Count of users in the group - Permissions — The capability keys assigned to this group - Status — ACTIVE or INACTIVE

2.2 Create a Group

Clicking Create Group opens a side sheet with:

Group Name

A unique human-readable name for the group (e.g., "Security Auditors", "AI Engineering Team").

Capabilities

A checklist of all available governance capability bundles. Each capability bundle grants access to a set of platform endpoints. Examples include: - read_events — View drift event stream - approve_reviews — Submit decisions on runtime reviews - manage_guards — Create and update guard configurations - export_ledger — Export the Immutable Ledger

Members

A checkbox list of all platform users. Select the users to add to this group.

2.3 Edit a Group

Clicking the menu icon (⋯) on any group row opens the same side sheet pre-populated with the group's current name, capabilities, and members. Changes are saved immediately on submission.

11. Permissions & Roles

Permissions & Roles provides a live, read-only view of the tenant's current Role-Based Access Control (RBAC) posture. It is an audit and reference tool that shows exactly which capabilities each role has access to.

11.1 Role Headcount

A metrics grid at the top of the page shows the number of users currently holding each role:

Role Description
admin Full platform access
compliance_manager Compliance and audit tool access
approver Approve reviews and endorsements
auditor Read-only across all lanes
engineer Design agents, guards, simulations
developer Create agents, manage API keys
viewer Read-only access

11.2 Capability Matrix

A comprehensive table mapping every governance capability to the roles that have access:

  • Rows — Each capability bundle (e.g., "Read Drift Events", "Approve Runtime Reviews", "Manage Guard Configurations")
  • Columns — Each role
  • Cells — ✓ (access granted) or ✗ (access denied)

Each capability shows: - A bold capability label - A short description - The backend API endpoints covered by this capability

11.3 Security Groups

Below the capability matrix, the current group posture is shown as a card grid:

  • Group Name
  • Permissions label — A summary of the capability bundles assigned to this group
  • Member count
  • Status — ACTIVE or INACTIVE

This section reflects the same groups managed in the Group Management page.