Users, roles and access
Roles, sign-in, entitlements, sensitivity classes and how every query is enforced.
Users, roles and sign-in#
| Role | Can |
|---|---|
| viewer | Explore, search, browse data, use Alfred and the SQL console under their entitlements. |
| modeller | Also edit drafts, upload Excel, run the Model check again. |
| publisher | Also publish and discard drafts. |
| admin | Also manage users, tokens, connectors, settings, the demo database, the activity log, and empty the ontology. |
Each of these roles can do everything the ones before it can. Separately, an editor role can be ticked on any user (an admin always has it): it is for the Library, not the model: together with a write or manage grant on a collection it allows ingesting, editing and approving documents. A user's roles are the rung they hold plus the extras, shown by /api/me as roles. Admins add users (or update an existing one) on Users & access > Users with a role, entitlements and a password, and can change a user's roles later without touching the password. The last admin cannot be demoted.
- Passwords need at least 12 characters and cannot be the username; they are stored with scrypt.
- A password set by an admin is temporary: the user picks their own at the next sign-in, and their other sessions end.
- Changing your password ends your other sessions.
- Sign-in is locked for 15 minutes after 5 failures for a username or 30 from one client address; while locked, even the right password is refused. An unknown username takes as long as a wrong password.
- Sessions are cookies that last
SESSION_HOURS(default 12). - The first admin comes from
INITIAL_ADMIN_USERNAME/INITIAL_ADMIN_PASSWORD, created only when there are no users.
Access control and data protection#
Sensitivity classes. Every field is one of:
| Class | Typically | Who sees it |
|---|---|---|
| internal | the structure and meaning of the model | everyone |
| confidential | financial and other business-sensitive values | holders of the class |
| personal | names, emails, phone numbers of persons | holders of the class; others get hashes where the field is masked |
| restricted | identity numbers, credentials and similar | only holders of the restricted entitlement, granted explicitly |
Entitlements are four switches per credential: confidential, personal, restricted, and data (may query data at all).
- New tokens start with confidential and personal, without restricted and without data (structure only until an admin grants it).
- New users start the same but with data.
- Restricted is always off unless granted explicitly; the page asks for confirmation, and every grant is logged.
- A user's entitlements govern what Alfred, the data browser and the SQL console show them. The model pages show every signed-in user the model's definitions (not data).
Agent access per field:
full: readable by whoever holds its class.masked: readable as a stable hash (h_+ 12 hex characters) by callers without the class. Equal values give equal hashes, so masked columns can still be selected, counted, grouped, ordered and joined, but never filtered, compared or transformed (which would let a caller recover the value).none: never readable without the restricted entitlement. These fields are also left out of search and of everything agents receive.
Enforcement. Every query from an agent, from Alfred or from the SQL console is parsed, every column traced to its real table through aliases, CTEs and subqueries, and checked against the caller's rights. The statement that runs is regenerated from the checked tree, never the text that was sent. Rules: one read-only statement; only tables the model describes; no system, file, network or administration functions (each database driver lists its own); restricted columns never without the entitlement; a hashed column only in the outermost select or in counts, groups, orders and joins. SQL written in the model itself goes through the same checks.
The database account is the second line of defence: always read-only, with timeouts; on the demo database also column grants per entitlement combination.