Best practices and FAQ

Design for least privilege

• Start from Viewer or Member and add only what's needed, rather than starting from Admin and taking away.
• Keep the number of Admins small — Admin includes user, role and billing management.
• Prefer a few well-named custom roles (e.g. "On-call", "Security Reviewer") over one-off per-person grants.

Review regularly

• Use each role's member count to spot roles that have drifted or are unused.
• Re-check who holds administrative permissions (users.manage, roles.manage, billing.manage) periodically.

Frequently asked questions

Who can manage roles?

Anyone whose roles include roles.manage (the built-in Admin role has it). Assigning roles to users additionally requires users.manage.

Can I edit the built-in roles?

No — Admin, Member and Viewer are locked so there's always a safe baseline. Create a custom role if you need a different set.

What happens if someone has no role?

They have no permissions and won't be able to access product features. Assign at least one role (Viewer is a good minimum).

I changed someone's roles but they still see the old access.

Role changes apply on their next sign-in or page refresh. Ask them to reload.