Organization and access
Organization and access
How a Vigilfield organization is structured: roles, user kinds, statuses, teams and grants.
Your organization is the boundary around everything in Vigilfield. It has its own sign-in address, <your-org>.vigilfield.com, its own users and teams, and a dedicated AWS account that Vigilfield operates for you.
This section is for the people who run the organization: the owner and the admins.
Roles
Every user has exactly one role.
| Role | Who | What they can do |
|---|---|---|
| Owner | One person per organization | Everything, on every resource. Only the owner can make someone an admin, change a user's role, change billing, and transfer ownership. |
| Admin | Anyone the owner promotes | Opens Administration. Manages users, invitations, teams, grants, verified domains, identity providers, apps and the storage key. Reaches data through their teams, like a member. |
| Member | Everyone else | Works with the data their teams can reach. Cannot open Administration. |
Some rules the server enforces:
- Nobody can give the owner role to another user, not even the owner. The only way to change owners is ownership transfer.
- Only the owner can grant the admin role. An admin can only create and invite members.
- An admin can edit only users with a lower role than their own. In practice, admins manage members, and the owner manages admins.
- The owner cannot change their own role.
User kinds
The Authentication field on a user shows how they sign in.
| Kind | Shown as | Signs in with |
|---|---|---|
| Native | Manual | Email and a Vigilfield password. |
| Federated | Federated (SSO) | Your identity provider. Vigilfield never holds their password. |
| App | App | Not a person. Apps use API credentials and never have a password or an admin role. |
User statuses
| Status | Meaning |
|---|---|
| Active | Can sign in. |
| Pending | The account exists but the person has not finished setting a password yet. |
| Inactive | Cannot sign in. Deactivating an active user also signs them out everywhere. |
Teams and access
Teams decide what data a person can reach.
- Every user belongs to at least one team. A user who would be left with none is put back in the Everyone team.
- Resources such as tables, rules, investigations and folders can have an owning team. Members of the owning team can do everything with that resource.
- A grant lets one team read or query something another team owns. Grants never give write access.
See Teams and grants.
Where to go next
- Signing in: the login page, passwords, and your profile.
- Users and invitations: add people and manage their roles.
- Teams and grants: organize people and share data.
- Verified domains: prove you own your email domain.
- Single sign-on and SCIM: connect SAML or OIDC, and provision users automatically.