Roles, delegation and organization hierarchy

Besides the two fixed roles («Member» and «Administrator»), the product has custom roles with delegated permissions and a hierarchy between organizations. These operations have their own rules.

The two fixed roles

Assign them under «Manage» › «Users» › «Edit». See Change a person's role or suspend them.

Custom roles and delegation

Under «Manage» › «Roles» («Roles and delegations») you can prepare roles with limited permissions (for example only reading users or only revoking sessions) and assign them.

These changes are authorised on a Presence authenticator (the high-assurance Android device), not in the browser: «Prepare a change for the Presence authenticator. This browser does not receive the protected catalog, does not sign the mutation and gains no IAM authority.» The console shows a QR the device reads; the device rereads the current state and confirms locally.

If your organization has no Presence authenticators, use the two fixed roles. The regular approver app does not authorise role changes.

Organization hierarchy

Under «Manage» › «Hierarchy» («Organization hierarchy»), an organization can propose or accept a parent or child organization, for example a business group with several companies. The link is also confirmed on a Presence authenticator. A parent can pass part of its licence to its children, and children can inherit the branding.

Who can do this for me?

If you need delegation or hierarchy and have no Presence authenticator, talk to your provider.