Security Groups

Overview

Access in the dashboard comes from one system. Each organisation has exactly one owner, who can do everything. Every other user gets access only from the security groups the user is in.

A security group is a name, a list of permissions, and a list of users. A permission gives one level of access to one resource. A group can only give access. It cannot take access away.

You manage groups on the Security groups page, which is in the sidebar under Organisation. You put users into groups on the Team & Security page.

If every user needs full access, the default groups are sufficient. You do not need the rest of this page.

Who has access

When two groups give different levels on the same resource, the user gets the higher level.

Centinel support staff who work in an internal view do not use group permissions. That path is outside your organisation and nothing on this page changes it.

Vocabulary

• Owner: the one user who holds every permission. See The owner.
• Resource: an area of the dashboard. See Resources and levels.
• Level: read, write, or admin. A higher level includes the lower levels.
• Permission: one resource with one level, for example write on policy_rules.

The owner

• An organisation has exactly one owner. The first user who joins a new organisation becomes the owner.
• The owner holds every permission and does not have to be in a group. The team list shows an Owner badge.
• Nobody can remove the owner or change the owner's access. Because of this, an organisation cannot lock itself out.
• The owner leaves the position only when the ownership moves to a different user.

Transfer the ownership

Only the owner can transfer the ownership. If the owner is not available, contact Centinel support.

The transfer is recorded on the Activity page.

Default groups

Each organisation has two default groups. Centinel creates them with the organisation.

• Admins: admin on every resource.
• Members: read on analytics, crawlers, and policy rules. Members does not give read on members, so a user who is only in Members does not see the team list.

You can edit the two default groups. You cannot delete them. A user can be in the two groups at the same time. That user has the access of Admins.

Resources and levels

The group editor shows only the levels that the dashboard checks. For each resource you select None, or one of the levels in the table.

Custom groups

Select New group on the Security groups page. Give the group a name and a description, and select a template. You can change each permission after you create the group.

A group applies to the full organisation.

Put a user in a group

When you invite the user. On Team & Security, select Invite member. Default group sets the group the new user joins: Members or Admins. Additional groups lists your custom groups. The user joins the selected groups when the user accepts the invitation.

An invitation link expires 30 days after you create it. Create a new link after that.

For a user who is in the team. Open the ⋯ menu of the user and select Manage groups. Select the groups and save.

To give a user full access, put the user in the Admins group. To stop that access, remove the user from the group.

The second permission stops a user who only manages the team from giving access that the user does not hold.

See the access of a user

Open the ⋯ menu of a user on Team & Security and select View access. The view shows the level the user has on each resource and the group that gives it. Use it for an access review.

View access is available to users with security_groups: admin.

Each change to a group, a permission, or a group membership is recorded with its state before and after, and shown on the Activity page.

Where the permissions are checked

The server checks the permission for each action. The sidebar shows only the pages that the user's permissions cover. The dashboard hides a control that the user cannot use. The server refuses the action if someone sends it anyway.

Examples

Auditor who sees everything and changes nothing

Invite the user with Default group set to Members. Then put the user in a group made from the Read-only auditor template. The user can then also read the team list, the settings, the settings history, and the Activity page. The user cannot change anything.

Policy editor who does not see traffic data

Make a custom group:

Resource      Level
policy_rules  write
crawlers      read

Put the user in this group only. Remove the user from Members, because Members gives read on analytics.

Team manager

Make a group from the Member manager template. The user can invite users into Members and remove them. The user cannot put another user in Admins.

What changed

Before, the dashboard had two systems: a role for each user (owner, admin, member) and the security groups. Now it has one.

The Restricted (read-only override) template is removed, because it used deny.

Common mistakes

• A user with no group. That user sees nothing. Put the user in Members or in a custom group.
• A user in Admins and in a smaller group. The smaller group limits nothing, because the user gets the higher level. Remove the user from Admins.
• security_groups: admin in a group for users without full access. See the warning in Resources and levels.

Related