User Roles and Permissions
Role-based access control (RBAC) ensures users access only the data and functions relevant to their responsibilities. Define your roles and operating model before provisioning users.
Built-In Roles
- Unit Manager: Administrative access scoped to an assigned business unit. Cannot manage users outside their unit.
Note: Apart from these, there are additional roles such as Manager, User, Administrator, etc. - Scanner: Can run scans but cannot view reports or modify configuration. Suitable for scan operators.
- Reader: Read-only access to dashboards and reports. Ideal for CISO-level stakeholders.
- Contact: Receives email notifications only. No platform access.
Navigate to Administration > Users > Roles to review and customize built-in roles, or create custom roles tailored to your organization's structure.
Recommended Admin Model
Map roles to the personas on your team, and apply least privilege at every level:
Persona |
Recommended Role |
Scope |
| Platform owner / primary admin | Super user (limited to one or two named individuals) | Full subscription |
| Business unit security lead | Unit Manager | Assigned business unit only |
| Vulnerability analyst | Custom role with scan and report access | Relevant asset tags |
| Scan operator | Scanner | Defined scan scope |
| Compliance / audit reviewer | Reader | Compliance dashboards and reports |
| Executive stakeholder | Reader | Executive dashboards |
Separation of Duties and Least Privilege
- Limit super-user access to the fewest individuals possible and protect those accounts with MFA.
- Separate who configures scans from who approves compliance exceptions.
- Scope every role to the asset tags or business unit each user needs, and nothing more.
- Review roles quarterly and remove access for users who change responsibilities or leave the organization.
- Use custom roles rather than over-provisioning built-in roles when a user needs only a narrow set of functions.