For administrators
You decide who can do what, and keep the tenant running.
Start here
Where most of this role's work happens.
- The governance model — the four enforcement layers
- Control access
- Compose roles and bind them to groups
Your work
| Task | Page |
|---|---|
| Compose roles and bind them to groups | Compose roles |
| Restrict access to particular records | Access control reference |
| Mask sensitive fields | Mask sensitive fields |
| Provision a tenant | Provision a tenant |
| Investigate an action | Investigate a change |
Principles worth holding
Build roles around jobs, not seniority. Roles named for rank accumulate permissions nobody can justify a year later.
Bind through groups. Access then follows joining and leaving automatically, which is the only arrangement that stays correct as people move.
Test with the account, not the theory. Effective permissions are the union of every role held directly and through groups. Reading a role definition tells you what one role grants — not what that person can do.
Grant assistant access freely. It grants no data access; the user's other permissions already decided that.
Two things that surprise people
Cross-tenant requests return 404, not 403. The row is genuinely invisible — isolation is enforced in the database, so nothing looked and refused.
Deactivation is immediate. Both the cached authorization context and the token's own identifier are checked per request, so deactivating a user stops them on their next call. You do not need to shorten token lifetimes to achieve it — that setting governs how often people re-authenticate.
Next
Last verified against commit 944761c7 (2026-08-03)