Limit dashboard actions with RBAC roles

Assign the administrator, poweruser, or user role to a dashboard account so it can only perform the actions its job requires.

This guide assigns a role, administrator, poweruser, or user, to a dashboard account, so its access to secrets, surfaces, and administrative views matches what its job actually requires. For how roles and permissions work, see Security and access control →.

Every dashboard account defaults to the user role, view-only across most feature families. Without deliberately assigning poweruser or administrator where it is genuinely needed, either every account stays limited to viewing, or accounts end up over-provisioned as administrators just to get past that limitation, gaining secrets and RBAC access they do not need.

Use this guide when:

  • An account needs to perform operational tasks, such as managing mediators or connection points, without full administrator access to secrets and RBAC.
  • An account genuinely needs administrator-only capabilities: secrets, API keys, certificates, RBAC itself, or governance and drift views.
  • You are auditing who currently holds administrator access and want to reduce it to the accounts that need it.

You do not need to change an account’s role if the default user role’s view-only access, plus its base edit/delete permission on pipes, notifications, and departments, already covers what that account does.

Prerequisites

  • Administrator role in the dashboard; assigning a role is administrator-only by default.
  • The account whose role you want to change, already created or signed up.

Steps

Open the account to change

Open Settings in the dashboard sidebar and switch to its Users tab. If the account is a new signup awaiting approval, approve it first.

Choose the role that matches the account’s job

The Edit User page, opened via Settings → Users, with the Role field showing the account's current role

Opening the Role field’s dropdown offers one of:

RoleGrants
UserView-only across most feature families, with edit/delete also granted for pipes (surfaces), notifications, and departments.
Power UserEverything User grants, plus operational write access: mediators and connection points. No access to secrets, API keys, certificates, RBAC, or administrator-only views.
AdministratorEvery permission, including secrets, RBAC, encryption, and administrator-only views such as governance records, drift, and attributed metrics.

Save the change

Save the account. The new role takes effect on the account’s next request.

Confirm

Test 1: a Power User account gets an access-denied response for Secrets, API Keys, Certificates, and RBAC

Sign in to the dashboard as the Power User account. Confirm Secrets does not appear in the sidebar, and that navigating directly to Secrets, API Keys, or Certificates redirects back to the dashboard instead of loading. Confirm the Users tab under Settings, where roles are assigned, is equally unreachable. Governance Records and Drift views should likewise redirect back to the dashboard if navigated to directly.

Test 2: a User account can still view and execute pipes, while the Users tab stays inaccessible

Sign in to the dashboard as the User account. Confirm it can still view and execute surfaces (pipes), notifications, and departments, since these feature families grant edit/delete access even at the base user role. Settings itself still appears in the sidebar, but only its own preferences and Limits tabs are open to this role; the Users tab, where roles are assigned, remains inaccessible.

Troubleshooting

SymptomLikely causeFix
A Power User account can still reach Secrets, API Keys, or RBAC.The account’s role was not actually changed, or reads Administrator rather than Power User.Re-open the account under Settings → Users and confirm the role picker shows Power User.
A User-role account cannot view or execute any surface.Pipes stay user-accessible by default, so a block here is unlikely to be RBAC itself; an OPA policy or a team gate is a more likely cause.Check the surface’s OPA policy and team attribution configuration separately; RBAC and OPA are independent mechanisms.
A feature seems unavailable to Power User or User, but reachable for Administrator.A feature entirely absent from the permission map is denied by default to Power User and User accounts; an Administrator account always passes the permission check regardless of the map.This is expected: the map is not customer-configurable, and a feature missing from it is Administrator-only until Affinidi adds it. Contact Affinidi if a feature should be reachable below Administrator.

Next steps