Roles and Permissions
UEC authorization has two dimensions: role/page capability and, where enabled, per-user device-group visibility.
UEC authorization has two dimensions: role/page capability and, where enabled, per-user device-group visibility. Both are enforced server-side.
| Role | Primary use | Shape |
|---|---|---|
| SuperAdmin | Tenant settings, credentials, modules, diagnostics | Full access |
| Admin | Policies, devices, operational configuration | Full operational access |
| SecurityAnalyst | Events, alerts, detections, investigation | Investigative access |
| Auditor | Audit, compliance and historical review | Read/review access |
| Viewer | Read/export permitted dashboards and lists | Broad read-only access |
Roles are not a strict ladder. A Viewer can have broad read access while lacking write actions; an Auditor’s access is shaped around review rather than general browsing.
Capability dimensions
Section titled “Capability dimensions”The server evaluates read, write and export capability per page. The UI follows a simple rule: if a role cannot perform an action, the control is removed rather than shown disabled. This prevents “the button was grey” from becoming an assumed permission boundary.
Sensitive operations can also require:
- Admin or SuperAdmin;
- password re-verification;
- an explicit indefinite flag;
- module enablement;
- capability support on the target OS/agent.
Per-user device-group scoping
Section titled “Per-user device-group scoping”When group scoping is enabled, a restricted user can be granted explicit base and supplemental groups. The server filters device and device-group queries to the union of granted devices.
| Property | Behaviour |
|---|---|
| Default for restricted user with no grant | Sees nothing |
| SuperAdmin/Admin | Full tenant visibility |
| Enforcement | Server-side query filters, not hidden UI |
| Dashboard aggregates | Recomputed for the caller’s scope |
| Device/group detail | Ungranted id returns no row/404 |
| Saved dashboards and report runs | Scope checked against supplied base group |
Current coverage
Section titled “Current coverage”| Surface | Scoped by device group? |
|---|---|
| Devices and device statistics/facets | Yes |
| Device groups and membership reads | Yes |
| Dashboard/discovery/analytics aggregates computed from Device | Yes |
| Saved dashboards and report schedules/runs | Yes, through supplied base-group checks |
| Alerts | Not yet |
| Events | Not yet; events live in ClickHouse outside the EF query filter |
| Policies | Not yet |
| EventHub live broadcasts | Not yet |
These exclusions are deliberate honest boundaries: alerts/events/policies remain tenant-wide rather than claiming a filter that is not present.
Identity controls
Section titled “Identity controls”- Local password policy is tenant-editable.
- SSO through Entra ID/OIDC and MFA are configurable.
- Conditional access can restrict sign-in context.
- Forced password change restricts the session and revokes old sessions after success.
- API tokens are scoped and expirable.
- MCP server operations are separately gated.
Operational review
Section titled “Operational review”- Review users and roles quarterly.
- Remove stale accounts and API tokens.
- Prefer group mailboxes for scheduled reports.
- Keep a break-glass SuperAdmin independent of SSO.
- Audit role and scope grants.
- Test restricted accounts by calling the API, not only by looking at the console.