Role-Based Access Control

Role-Based Access Control (RBAC)

SkySaver uses Role-Based Access Control to manage what users can do within the platform. This section covers the available permissions and how to configure them.

Permission Model

SkySaver uses a scope-based permission system where:

  • Scopes are individual permissions for specific actions
  • Users can have any custom combination of scopes
  • Permissions are project-specific

Note: SkySaver does not have a role abstraction in the UI. Permissions are assigned as individual scope checkboxes in the Edit User dialog. The “Admin / Member / Viewer” concepts below are logical groupings to help guide what to assign — they are not roles you select from a dropdown.

Conceptual Permission Levels

These groupings describe common access patterns:

LevelDescriptionUse Case
AdminFull access to all features (or assign org:poweruser)Project administrators
MemberStandard access with modificationsTeam members
ViewerRead-only accessStakeholders, auditors

Assigning Admin Role

  1. Navigate to Tenant Management > Users tab
  2. Click the ⋯ menu on the user and select Edit User
  3. Check org:poweruser in the permissions list
  4. Click Save Changes
org:poweruser grants full admin access

The org:poweruser scope grants unrestricted access to all project resources and settings — equivalent to full admin. Assign it only to users who genuinely need project-wide administrative control. There is no visual distinction for this scope in the UI beyond its checkbox label.

Available Scopes

The following 13 scopes are available in the Edit User dialog:

Account Permissions

ScopeDescription
read:accountsView accounts and their details
write:accountsAdd new accounts to the project
manage:accountModify account attributes
delete:accountsRemove accounts from the project

Member Permissions

ScopeDescription
read:project_membersView project members
write:project_membersAdd new members
manage:project_membersModify member attributes
delete:project_membersRemove members

Project Permissions

ScopeDescription
manage:projectModify project settings

Schedule Permissions

ScopeDescription
read:schedulesView schedules
write:schedulesCreate new schedules
manage:schedulesModify existing schedules

Organization Permissions

ScopeDescription
org:poweruserFull admin access — see warning above

Edit User Modal Edit User Modal

Scope Categories

Understanding scope naming:

PrefixMeaning
read:View/list resources
write:Create new resources
manage:Modify existing resources
delete:Remove resources
org:Organization-level capabilities

Assigning Permissions

Step 1: Open Edit User

  1. Navigate to Tenant Management and click the Users tab
  2. Click the ⋯ menu on the user row and select Edit User

Edit User Edit User

Step 2: Select Scopes

  1. Check desired permission scopes
  2. Uncheck any scopes to remove them

Update User Update User

Step 3: Save

Click Save Changes to apply.

Common Permission Sets

Read-Only User (Viewer)

For users who only need to view data:

read:accounts
read:project_members
read:project
read:schedules

Schedule Manager

For users who manage schedules but not accounts:

read:accounts
read:project
read:schedules
write:schedules
manage:schedules

Account Manager

For users who manage AWS accounts:

read:accounts
write:accounts
manage:account
read:project

Full Access (Admin)

All scopes, or use the org:poweruser scope.

New User Defaults

New users start with no permissions:

  1. User is added to project
  2. User has blank access
  3. Admin must assign scopes
  4. User can then access features

Important: Always assign permissions after adding users.

Auditing Permissions

Regularly review user permissions:

  1. Navigate to Tenant Management > Users tab
  2. Review each user’s scopes
  3. Verify access is still appropriate
  4. Remove unused permissions

Security Best Practices

  1. Least privilege - Grant only what’s needed
  2. Regular audits - Review permissions quarterly
  3. Prompt removal - Remove access when users leave
  4. Limit admins - Keep admin count minimal
  5. Document - Record why users have specific access

Troubleshooting

IssueCauseSolution
Can’t view accountsMissing read:accountsAdd the scope
Can’t create schedulesMissing write:schedulesAdd the scope
Can’t edit settingsMissing manage: scopeAdd appropriate manage scope
Access deniedMultiple missing scopesReview required scopes