Manage Users and Access

Manage Users and Access

Sign in with tenant user-management authority. Open Admin → Users, choose the intended tenant user and use the available membership/role controls. Tenant roles include tenant_admin, tenant_ingest_manager, and tenant_analyst; system-admin authority is reserved for platform administration.

Example: give a reporting colleague the analyst role, then verify that their login can read the intended tenant's reports. Do not give them platform authority to solve a missing report or failed query. End membership when access is no longer needed and verify that the membership state changed.

For machine access, use Machine Clients and Credentials. Create only the purpose/scopes required by the integration. Capture a one-time credential through your approved secret store. For rotation, update the consuming application and verify a small authorized request before retiring the old credential. Never put credentials into browser bundles, tickets or screenshots.

Expected result: the intended user's membership/role or machine credential state is visible and the authorized action works. If a mutation fails, inspect its permission/validation error and verify tenant context before retrying. Reauthenticate after a role change if the session still carries old claims.

Support Access is currently a system-only Admin section; tenant administrators must not assume it is present in their navigation.