Skip to content

Policy

Roles & access

What one person may do, and which apps they may sign in to.

Svenska

Local mode: no sign-in on this machine. Never expose it beyond localhost.

Find a person

Person

Checking whether this auth host exposes the roles API…

Console roles

viewer
Overview, fleet and services — read only.
auditor
Reads everything: people, devices, policy and the audit log.
editor
Viewer, plus devices, live sign-ins and liveness checks.
manager
Invites, approves, revokes and offboards people; edits roles, access and apps.
admin
Everything — organizations, permissions, recovery codes and other admins.

Organizations may use their own role names; the permission table gives them meaning.