> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuraltrust.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# User & Roles

> Manage who belongs to your NeuralTrust organization — users, invitations, platform roles, and per-product permission levels.

# User & Roles

**User & Roles** is where you manage membership and access for the organization. It has four tabs:

| Tab             | Purpose                                         |
| --------------- | ----------------------------------------------- |
| **Users**       | Active members and their access level           |
| **Invite sent** | Pending invitations                             |
| **Roles**       | Predefined and custom role templates            |
| **Permissions** | In-product reference for what each level can do |

Open it from the sidebar gear → **Platform settings → User & Roles**.

Managing users and roles requires **IAM Admin** access (or Owner / Global Admin / Break the Glass, which include it).

***

## Access model

Access has two layers:

1. **Org roles** — Owner, Global Admin, Break the Glass, plus product templates (Admin / Editor / Viewer). Owner and Global Admin have **Admin on every product** plus billing; Owner can also **delete the organization**. Break the Glass has the same permissions as Global Admin (emergency password login — see [Break-glass](/platform/break-glass)).
2. **Product permissions** — No access, Viewer, Editor, Admin — set per product (and optionally scoped to specific TrustGate gateways or TrustGuard collectors).

**Roles** in the Roles tab are reusable templates that apply an org role or a product permission matrix when you invite or edit a user.

Normal users are **passwordless** (magic link or SSO). Only Break the Glass accounts use a password (minimum 30 characters).

### Structural roles

| Role                | Who                          | Capabilities                                                                             |
| ------------------- | ---------------------------- | ---------------------------------------------------------------------------------------- |
| **Owner**           | Exactly one per organization | Everything a Global Admin can do, plus transfer ownership and delete the organization    |
| **Global Admin**    | Multiple allowed             | Admin on all products and Platform Settings, including billing                           |
| **Break the Glass** | Emergency accounts           | Global Admin permissions, password login without MFA, sign-ins alert organization admins |

See [Break-glass access](/platform/break-glass) for the difference between Break the Glass *accounts* and the SSO break-glass *email list*.

### Product permission levels

Levels nest: Viewer ⊂ Editor ⊂ Admin.

| Level         | Meaning                                                                     |
| ------------- | --------------------------------------------------------------------------- |
| **No access** | Product is hidden for that user                                             |
| **Viewer**    | Read-only access inside the product                                         |
| **Editor**    | Create and modify resources (cannot delete or configure sensitive settings) |
| **Admin**     | Full control of the product, including delete and configuration             |

### Capability summary by product

| Product        | Viewer                                       | Editor (+ Viewer)                        | Admin (+ Editor)                                              |
| -------------- | -------------------------------------------- | ---------------------------------------- | ------------------------------------------------------------- |
| **TrustGate**  | View policies, consumers, registry           | Edit policies / registry, run playground | Manage consumers, configure gateway, delete gateway resources |
| **TrustGuard** | View runtime policies, detectors, collectors | Edit those                               | Configure runtime, delete runtime resources                   |
| **TrustTest**  | View targets, scenarios, runs                | Edit and run tests                       | Manage API tokens, delete resources                           |
| **TrustLens**  | View inventory                               | Edit inventory                           | Delete resources                                              |
| **Telemetry**  | View dashboards and alerts                   | Edit use cases                           | Configure SIEM integrations, delete telemetry resources       |
| **IAM**        | View users and roles                         | Manage invitations                       | Manage users, roles, and SSO                                  |

The **Permissions** tab in the UI shows the same cards filtered to the products contracted for your organization.

### Predefined role templates

| Template            | Effect when applied                                              |
| ------------------- | ---------------------------------------------------------------- |
| **Global Admin**    | Marks the user as Global Admin                                   |
| **Break the glass** | Marks the user as Break the Glass and provisions a long password |
| **Admin**           | Admin on all shippable products                                  |
| **Editor**          | Editor on all shippable products                                 |
| **Viewer**          | Viewer on all shippable products                                 |

Custom roles let you pick an arbitrary matrix of product levels (and gateway / collector scopes for TrustGate / TrustGuard). Global Admin and Break the Glass templates are view-only — they cannot be edited or duplicated.

***

## Users

The Users tab lists every active member. Columns:

| Column           | What it shows                                                                                |
| ---------------- | -------------------------------------------------------------------------------------------- |
| **User**         | Avatar, name, and email                                                                      |
| **Access Level** | Owner, Global Admin, Break the glass, or a summary of product Admin / Editor / Viewer counts |
| **Last login**   | Most recent successful sign-in                                                               |

Toolbar: search, filter by access level, refresh, **Add User**.

### Add a user

1. Click **Add User**.
2. Enter the invitee's email.
3. Optionally apply a **role** template, or set the permission matrix manually (products + platform modules).
4. For TrustGate / TrustGuard, optionally restrict access to specific gateways or collectors.
5. If you choose **Break the glass**, set a password of at least **30** characters. The account is created active and the user is notified.
6. Send the invitation.

The invite appears under **Invite sent**. When accepted, the user moves to **Users**.

<Note>
  If the organization enforces SSO, invitees sign in through your identity provider. If SCIM or Entra user sync is enabled, most users should be **provisioned automatically** — see [SCIM](/platform/scim) and [User sync](/platform/user-sync).
</Note>

### Edit access

Use **Edit** on a user row to change their role template or permission matrix. The Owner row is read-only for access changes — transfer ownership instead.

### Transfer ownership

Owners can transfer ownership to an eligible member:

1. Open the row actions → **Transfer ownership**.
2. Type the member's email to confirm.

The previous Owner becomes a **Global Admin**. There is always exactly one Owner.

### Remove a member

Removing a member immediately revokes their sessions and product access. Past audit events remain (actor email stays as-is).

Anti-lockout rules prevent removing the last Global Admin path that would leave the organization unmanageable.

If the user was provisioned by SCIM, they may be re-created on the next IdP sync unless you also remove them upstream. For SCIM-managed organizations, **deprovision in the IdP**.

***

## Invite sent

Lists invitations that have not been accepted yet (and related invite statuses). For each pending invite you can:

* **Resend** — send the invitation email again.
* **Cancel** — revoke the invitation so the link stops working.

***

## Roles

Create and manage **custom** roles, or view predefined templates.

| Action                    | Allowed for                              |
| ------------------------- | ---------------------------------------- |
| Create custom role        | IAM Admin+                               |
| View permissions          | Anyone with Identity & Access visibility |
| Duplicate / edit / delete | IAM Admin+                               |

When inviting or editing a user, picking a role applies its template in one step. SSO [group mappings](/platform/user-sync) can also target platform roles.

***

## Permissions tab

Educational reference cards for No access, Viewer, Editor, Admin, Global Admin, Owner, and Break the Glass — the same matrix documented above, filtered to your contracted products.

***

## Related

* [General](/platform/general) — organization name, leave, and delete.
* [Microsoft Entra ID SSO](/platform/sso) / [Generic OIDC SSO](/platform/generic-oidc-sso) — sign-in for members.
* [SCIM Provisioning](/platform/scim) — automate member creation and removal.
* [User sync & group mappings](/platform/user-sync) — map IdP groups to platform roles.
* [Break-glass access](/platform/break-glass) — SSO email allowlist and Break the Glass accounts.
* [Audit Logs](/platform/audit-logs) — invites, accepts, role changes, and removals are recorded.