Concepts
Roles and permissions
Learn how Verentis decides what each person, service, or API key can do.
Roles and permissions are how Verentis controls access. They decide what someone can see, change, create, or manage.
A simple way to think about it is a workplace. Your job title gives you a set of responsibilities. You do not receive each responsibility one by one every morning.
Permission
A permission is one single ability.
Examples might be:
- Upload a file.
- Invite a user.
- Create a role.
Permissions can also have machine-readable names, such as security.role.create. These names help software be precise. Most of the time, you work with friendlier roles instead.
Role
A role is a named bundle of permissions.
For example, a role named "Workspace admin" might include permissions to manage users, services, settings, and content.
Roles save time. Instead of ticking dozens of boxes for each person, you give them the role that matches their work.
Grant
A grant is the act of giving access.
You can grant a role, or you can grant a single permission. Grants can be given to a user, service, or API key.
Account and workspace access are separate
An account is the top-level container in Verentis. A workspace is a working area inside an account. One account can have many workspaces.
Access is managed at both levels:
- Account-level access controls what someone can do for the account.
- Workspace-level access controls what someone can do inside one workspace.
The screens work the same way, but the access is separate.
Being an account admin does not automatically make you a workspace admin. If a person needs admin access in a workspace, grant it at the workspace level too.
How effective access is worked out
A person's effective access means what they can actually do after all grants are combined.
Verentis looks at:
- permissions from every role they have, plus
- any individual permissions granted directly to them.
If any grant gives them a permission, they have that ability.
A small example
Mina joins your team.
At the account level, you grant Mina the "Billing viewer" role. That lets her view account billing information.
In the "Product content" workspace, you grant Mina the "Editor" role. That lets her upload and update content in that workspace.
Later, Mina also needs to create roles in that workspace. You grant her the single security.role.create permission there.
Mina's effective workspace access is now the Editor role plus the extra role-creation permission. Her account access is still only billing view access.