People, access and audit
Where membership and roles, single sign-on, support access and the audit log are documented — one page each — and where the permission matrix went.
Concept · Updated 2026-10-17 · Describes release 0.1.164
Settings · Account → Members & roles (/portal/members) manages membership, roles, single sign-on and workspace features; Settings · Account → Audit log (/portal/audit) holds the append-only trail you hand to an auditor; Appearance sets the brand for everyone. Access is a set of sixteen permission keys grouped into roles, membership is the only door to your data — platform staff have no bypass, only an expiring grant you can see and revoke — and every consequential act lands in a hash-chained audit log that nothing edits. This chapter is now one page per subject; what leaves your network and where credentials live stays in Security and data, and every term is defined once in the Glossary.
The pages
- Members and roles — invite, re-role and remove members, create custom roles, what every workspace includes, the tenant brand, roles and personal preferences.
- Single sign-on — register this platform at your provider, connect it, map groups to roles, test discovery, what login looks like, why SSO can never mint a tenant admin.
- Support access — the break-glass grant platform staff use when you ask for help, and what staff can and cannot see without one.
- Audit log — what is recorded, filter and search, verify the chain, export evidence for an auditor, what the log records for a notification.
- Permissions — the reference: the permission matrix and the navigation and action permissions per destination.
Where the old sections went
| Old section | Now |
|---|---|
| Concepts | Account vs membership, role and included features on Members and roles; the permission key on Permissions; no superadmin bypass on Support access; the hash-chained audit on Audit log |
| The permission matrix · Navigation and action permissions | Permissions |
| Create a custom role | Members and roles |
| Managing members · Feature availability · Appearance | Members and roles |
| Per-tenant SSO | Single sign-on |
| Support access (break-glass) · What platform staff can and cannot see | Support access |
| The audit log · Notification setup checks | Audit log |
| Use cases, troubleshooting, limits and gotchas | Each page keeps the rows about its own page |