One role, one permission set
Every user carries a named role with an associated permission dictionary. Each API endpoint is protected by this mechanism: a missing permission means a server-side refusal, not merely a hidden button.
Granularity
Permissions cover customers, projects, vulnerabilities, the calendar, reports, invoicing, groups, users, settings and licensing: each with a read and a write distinction.
Automatic scoping by role
- Administrators see every project
- Auditors and project managers see only their assigned projects
- Managers see only projects belonging to groups they are members of
- A project manager tied to a client account sees only their organisation projects
A manager cannot add administrators or other managers to their groups. This restriction prevents privilege escalation through group membership.
Structural safeguards
The last administrator account can neither be deleted nor demoted, and system roles cannot be removed. These guardrails stop you locking yourself out of your own instance.