Role-based access control

SQIP evaluates authorization against the tenant that owns the requested resource. A role supplies baseline permissions, and optional user grants can add capabilities for one tenant. Access to one tenant never implies access to another.

How effective access is calculated

For a tenant member, effective access is the union of:

1. The baseline permissions supplied by the member's role.
2. Additional permissions assigned to that member in the selected tenant.

Additional grants are additive. They cannot remove a permission inherited from a role. To reduce access, first choose a narrower role and then add only the required permissions.

Platform administrators use a separate realm-level boundary. They can operate across tenants but are not listed or managed as ordinary tenant users.

Standard roles

The tenant creator is treated as that tenant's tenant-admin. A realm-level tenant-admin does not automatically receive another tenant's data; the identity must own or be assigned to that tenant.

Role boundaries that grants cannot cross

Some connector changes require actual tenant-administrator authority, even if a user has other connector grants:

• Install a connector.
• Change connector configuration.
• Rotate connector credentials.
• Delete a connector runtime.

The delegable connector permissions cover viewing, operating, logs, and metrics. This keeps credential-bearing and destructive lifecycle changes with tenant or platform administrators.

Manage role assignments

Open Access and RBAC → Users, choose a tenant, and select Edit access or Assign access.

• Permissions included by the selected role are enabled and locked.
• Other switches are additional grants for the selected tenant.
• Save access updates both the membership role and its additional grants.
• Permission layer filters the directory; it does not change access.

See the Access guide for the complete permission reference and the User management guide for account lifecycle tasks.

Least-privilege examples