Role-Based Access
How role-based access control works in ThreatSabre, covering tenant-level roles for administering tenants and organisation-level roles for working with devices and exceptions.
ThreatSabre uses role-based access control (RBAC) at two distinct levels: tenant roles govern who can administer a tenant and its resources, while organisation roles govern what a user can do inside an individual organisation. These two layers work together to give you fine-grained control over who can see and change what.
For more on how tenants, organisations, groups, and permission profiles fit together, see Multi-Tenancy.
Table of Contents
Two Layers of Access Control
| Layer | Purpose | Assigned To |
|---|---|---|
| Tenant role | Controls administration of the tenant itself — managing members, groups, organisations, invitations, and sharing. | Each user, per tenant they belong to. |
| Organisation role | Controls what a user can do inside a specific organisation — viewing data, managing exceptions, onboarding devices. | A user group, per organisation it is assigned to (via a permission profile). |
A user's effective access in any given organisation is the combination of their tenant role and the organisation role granted by their group membership.
For organisations using Enterprise SSO, tenant Admin / Member and user-group membership can be driven by IdP group mappings on each sign-in. Tenant Owner cannot be granted via SSO.
Tenant Roles
Every user in a tenant is assigned one of three tenant roles, each with increasing privileges:
| Role | Description |
|---|---|
| Member | Basic access. Can access organisations assigned to them within the tenant but cannot perform administrative actions. |
| Admin | Can manage members, groups, organisations, and invitations. Can initiate sharing workflows — including creating, viewing, and revoking sharing codes, viewing shared organisations and incoming shares, removing incoming shares, and viewing allowed profiles. Cannot complete the sharing handshake or make high-impact sharing changes. |
| Owner | Full control including all Admin capabilities, plus: assigning the Owner role to others, validating and redeeming sharing codes, unsharing organisations from other tenants, setting allowed permission profiles on shared organisations, and managing billing (coming soon). |
For a detailed breakdown of which actions each tenant role can perform, see Roles in Multi-Tenancy.
Organisation Roles
Organisation roles are applied through permission profiles assigned to user groups. When a group is assigned to an organisation with a given profile, every member of that group gains the corresponding level of access inside that organisation.
| Role | Description |
|---|---|
| Reviewer | Read-only access to the system. Can view devices, findings, and reports but cannot make changes. |
| Engineer | Everything a Reviewer can do, plus the ability to manage exceptions on findings. |
| Admin | Everything an Engineer can do, plus the ability to onboard new devices into the organisation. |
What Each Organisation Role Can Do
| Action | Reviewer | Engineer | Admin |
|---|---|---|---|
| View devices, findings, and reports | Yes | Yes | Yes |
| Manage exceptions on findings | — | Yes | Yes |
| Onboard new devices | — | — | Yes |
Note: The organisation-level Admin role is separate from the tenant-level Admin role. A user can be a tenant Member while still being an organisation Admin in one or more organisations, and vice versa.