Deep Dive
User management
Add, assign, update, synchronize, and remove tenant users
Use Access and RBAC → Users to manage human access. This workspace contains tenant identities only; platform administrators and super-administrators are intentionally excluded from it.
Required permissions
| Task | Permission |
|---|---|
| View the tenant directory | users:read |
| Add a user, assign an existing identity, or change access | users:manage-access |
| Remove a tenant membership | users:delete |
A platform administrator can perform these tasks across tenants. A tenant-admin receives all three permissions by role.
Add a tenant user
Before adding a new user, the platform administrator must configure outbound email in the identity service. SQIP verifies this before it creates tenant access.
- Open Access and RBAC → Users.
- Select the tenant.
- Enter the person's full name and valid work email.
- Choose the narrowest suitable role.
- Enable any additional tenant-specific permissions.
- Select Add user.
SQIP creates or reuses the identity, sends an activation email requiring email verification and password setup, and grants tenant access only after that message is accepted by the identity service. If activation delivery fails, SQIP does not create the tenant membership.
Note
If an identity with that email already belongs to the selected tenant, SQIP rejects the duplicate assignment. Use Edit access instead.
Assign a synchronized identity
Platform views can load non-platform identities from the central authentication service. Select Sync CAS users, find an identity marked not assigned, and choose Assign access.
For an ordinary tenant administrator, the directory is limited to current members of that tenant. Platform identities never appear in the tenant directory.
Change access
- Select Edit access for the member.
- Change the role if its baseline is too broad or too narrow.
- Enable additional grants needed only in this tenant.
- Select Save access.
Role permissions appear enabled and locked. Additional grants are additive; changing to a narrower role is the only way to remove an inherited capability.
Remove access
Select the remove action and confirm the tenant membership removal.
- You cannot remove your own tenant-administrator access.
- Access to the selected tenant is removed immediately.
- Other tenant memberships are preserved.
- When no memberships remain, SQIP also deletes the underlying identity.
- Platform identities cannot be removed through tenant RBAC.
Review rbac_user.created, rbac_user.assigned, rbac_user.updated, and rbac_user.deleted events in Audit Logs when investigating access changes.
Offboarding checklist
- Confirm all tenants the person can access.
- Transfer ownership of operational procedures and secrets; do not transfer personal accounts.
- Remove the person's membership from each tenant.
- Revoke application keys only if the person also controlled their storage or distribution.
- Review Audit Logs for the completed changes.