Users and roles
Tracix has two kinds of roles. An organization role decides what someone can do in the console. A workspace role decides what they can do inside one workspace. Custom roles add permissions from the same catalog on top of the built-in roles.
Organization roles
You manage organization roles in the console under Team.
| Role | What it can do | How someone gets it |
|---|---|---|
| Owner | Everything, including the actions reserved for the Owner, such as assigning the Owner role | Creating the organization at sign-up |
| Admin | All organization administration: members, roles, workspaces and their access, single sign-on, SCIM, security policy and billing | An invite, or single sign-on |
| Member | Sees the organization's workspaces in the console. What they can do inside a workspace depends on their workspace role | An invite, or single sign-on |
| MSP admin | The same permissions as Admin, for managed service providers | Single sign-on only, through your SSO settings |
| MSP viewer | Read-only access to the organization's console pages | Single sign-on only, through your SSO settings |
| A custom role | The Member baseline plus the permissions you choose | An invite |
The Roles & permissions tab on Team lists the built-in roles with their permission counts, and your custom roles.
Workspace roles
Each person's access to a workspace is set on that workspace's Access tab in the console. Nobody can open a workspace without a workspace role, organization Admins included; the person who creates a workspace starts as its Admin.
| Role | Permissions |
|---|---|
| Admin | Every workspace permission, including the manage, apply and approve actions |
| Editor | Every read and write permission: build dashboards and monitors, edit policies and devices, and run queries. No manage, apply or approve actions |
| Viewer | Every read permission, plus their own profile, such as Brain memory notes |
The manage, apply and approve actions are the ones only a workspace Admin holds, unless a custom role grants them. They cover managing collectors, integrations, discovery, APM, RUM, security, log pipelines, on-call, notification channels, workflows, Auto-Fix, AI settings, credentials, data lifecycle and workspace settings, approving Auto-Fix changes, and applying and approving network configuration changes.
Custom roles
A custom role is a named set of permissions, such as "logs and monitors only" or "read-only APM". Someone with a custom role gets the Member baseline plus exactly the permissions you pick.
Create a custom role
Open the roles tab
In the console, open Team, select the Roles & permissions tab and select Create role.
Name it
Enter a Name of 2 to 40 characters, such as
Support engineer, and an optional description of up to 200 characters. The name can't be a built-in role's name.Choose permissions
Permissions are grouped under Organization, for console pages, and Workspace, for product pages inside a workspace. Toggle all read selects every
readpermission in a group. Select Create role.Assign it
Choose the role in Invite member when you invite someone.
How custom roles work:
- Organization permissions are read-only. Administering the organization, its members, roles, workspaces, billing, single sign-on, API keys and feature flags stays with Admins, so a custom role can never widen itself.
- Workspace permissions add to the workspace role. They apply in every workspace the person can open, on top of their role there. They don't give access to a workspace on their own.
- Editing and deleting. Edit a role with the pencil icon. A role assigned to members or pending invites can't be deleted until you reassign them.
- An organization can have up to 50 custom roles.
Single sign-on replaces custom roles
If your organization uses single sign-on, each SSO sign-in sets the person's organization role from your default role and group mappings and removes any custom role. Owners keep their role. See Single sign-on.
Change someone's role
- Workspace role: on the workspace's Access tab, choose a new role from the menu on the person's row.
- Organization role: not yet in the console. The Team page shows each member's role but has no role editor. Today, remove the member and invite them again with the new role, or, with single sign-on, change their groups in your identity provider; the new role applies at their next sign-in.
Permission reference
Every permission is a surface and an action, such as monitors.write. The catalog has 52 surfaces: 44 inside a workspace and 8 in the organization.
Workspace surfaces
| Actions | Surfaces |
|---|---|
read | overview, network_flows, bgp, sdwan, topology, databases, endpoint_experience, hosts, containers, kubernetes, cloud_assets, logs, traces |
read, write | policies, network_devices, synthetics, metrics, visualizations, dashboards, monitors, alerts, incidents, slos, downtimes, correlation_rules, ml_anomaly, variables, profile |
read, manage | collectors, integrations, discovery, apm, rum, security, log_pipelines, oncall, notification_channels, ai_settings, credentials, workspace_settings |
read, write, apply, approve | ncm |
read, write, manage | workflows |
read, write, manage, approve | autofix |
read, manage, apply | data_lifecycle |
Organization surfaces
| Surface | Actions | Covers |
|---|---|---|
deployments | read, create, manage, delete | Workspaces: listing, creating, access and lifecycle |
organization | read, manage | Organization settings and security policy |
team | read, manage | Members, invites and roles |
billing | read, manage | Plan, usage, invoices and payment |
api_keys | read, manage | Organization-level API keys. No console page uses it yet |
sso | read, manage | Single sign-on and SCIM |
audit_log | read | The organization's audit log. No console page shows it yet |
feature_flags | read, manage | Feature flags. No console page uses it yet |