Users & Roles

Users & Roles

The Users & Roles module provides comprehensive identity and access management (IAM) for the platform. It enables organizations to implement strict role-based access control (RBAC), enforce least privilege, and maintain clear segregation of duties.

---

Users

The Users interface allows administrators to create, manage, and monitor platform users.

Users Inventory

The user list provides:

• Name
• Email
• Username
• Assigned Roles
• Status (Active / Inactive)
• Last Login
• Quick action menu

User Actions

Per-user actions include:

• View details
• Edit user
• Deactivate account
• Reset password

All actions are fully audited.

Create User

To create a new user:

1. Provide first and last name
2. Enter email address
3. (Optional) Set username
4. Assign one or more roles
5. Set status (Active / Inactive)
6. Save

Users can be provisioned for:

• Developers
• Approvers
• Auditors
• Security administrators
• Platform administrators

---

Roles & Permissions

Roles define what users are allowed to do within the platform.

Roles Inventory

The roles list shows:

• Role name
• Description
• Number of assigned users
• Status
• Last updated timestamp

Create Role

When creating a role:

1. Define role name
2. Provide optional description
3. Select permissions grouped by category
4. Activate role

Permissions are granular and grouped by domain (Users, Keys, Policies, Signing, Reports, Agents, etc.).

Role Permissions

Permissions are assigned at fine-grained levels, such as:

• users:read
• users:write
• users:deactivate
• keys:create
• keys:rotate
• policies:write
• signing:approve
• audit:read
• reports:generate

Users inherit the union of permissions from all assigned roles.

Role Details

Role detail view displays:

• Status
• Assigned users
• Last updated metadata
• Complete permission list
• Change history (audited)

---

Access Control Model

The platform enforces:

1. Authentication

• Username/password
• MFA (if enabled)
• SSO integration (SAML / OIDC)

2. Authorization

• Role-based access checks
• Permission-level enforcement
• Deny-by-default security model

3. Audit Logging

Every identity-related action is logged:

• User creation
• Role assignment
• Permission changes
• Account deactivation
• Login attempts

---

Segregation of Duties

RBAC enables strict separation between:

• Key administrators
• Signing users
• Approvers
• Auditors
• Platform administrators

For example:

• Developers can request signing but cannot rotate keys
• Approvers can approve but cannot initiate signing
• Auditors can view logs but cannot modify resources

This supports:

• SOC 2
• ISO 27001
• PCI DSS
• NIST frameworks

---

Security Benefits

The Users & Roles module provides:

• Least Privilege Enforcement
• Clear Accountability
• Centralized Access Control
• Compliance-Ready Access Reviews
• Rapid Access Revocation

Robust identity and access management is foundational to secure enterprise code signing governance.