Dashboard guide
Roles and permissions
Each member of an environment has one role there. The console disables buttons your role may not use and shows why (for example "Needs the operator or admin role"). The server checks the same rules again, so hiding a button is never the only protection.
| viewer | approver | operator | admin | owner | |
|---|---|---|---|---|---|
| See everything of the environment (findings, hosts, plans, audit log, reports) | yes | yes | yes | yes | yes |
| Request changes: create plans, Fix, bulk fix, Fix all | yes | yes | yes | ||
| Approve or reject plans of others | yes | yes | yes | ||
| Accept a risk (exception) | yes | yes | |||
| Approve new agents, revoke agents, create installation lines and enrollment tokens | yes | yes | |||
| Maintenance windows, notifications, domains, probes, settings | yes | yes | |||
| Kill switch (activate and release) | yes | yes | |||
| Invite members, change roles | yes | yes (only an owner can make someone owner) | |||
| Approval policy (approvals without a security key) | yes |
Notes:
- Four eyes: nobody approves their own plan. An operator requests, an approver (or admin or owner) approves. See Approvals.
- Approvers do not request. The approver role exists so the person who approves is not the person who asks.
- Single-admin environments: if only one member may approve, that person can approve their own plan after a waiting period (15 minutes by default) that can be cancelled. The console shows a notice when this applies.
- Step-up: some actions ask for your security key again, see Sign-in.
- SEK Systems support only works in your environment as a member, and its actions show up in your audit log as "SEK Systems support".
Change roles under Settings → Access & SSO → Members (owner or admin, with a step-up).