Skip to main content

Permissions

Configure role-based permissions to control what administrators can do in your Containment.AI organization.

Permission Levels​

View​

Can view but not modify:

  • See dashboard and reports
  • View alerts (read-only)
  • Browse policies
  • View client list

Manage​

Can view and modify:

  • Create, edit, delete items
  • Change settings
  • Take actions

Admin​

Full control:

  • All manage permissions
  • User management
  • Settings access
  • Integration configuration

Built-in Roles​

Owner​

  • Full access to everything
  • Cannot be removed
  • Can transfer ownership
  • One per organization

Administrator​

  • All permissions except:
    • Billing management
    • Owner transfer
    • Organization deletion

Analyst​

  • Alert management
  • Report generation
  • View policies
  • View clients

Viewer​

  • Read-only access
  • View dashboard
  • View alerts
  • View reports

Custom Roles​

Enterprise

Create roles tailored to your organization:

Creating a Custom Role​

  1. Go to Settings > Permissions
  2. Click Create Role
  3. Enter role name and description
  4. Select permissions
  5. Save

Permission Categories​

CategoryPermissions
DashboardView overview, metrics
AlertsView, acknowledge, resolve
PoliciesView, create, edit, delete
ClientsView, invite, manage
ActivityView logs, export
IntegrationsView, configure
SettingsView, edit various settings
AdminsView, invite, manage
BillingView, manage

Granular Permissions​

Each category has specific permissions:

Alerts Permissions

  • alerts.view - See alert list
  • alerts.acknowledge - Mark as seen
  • alerts.resolve - Close alerts
  • alerts.dismiss - Mark as non-issue
  • alerts.export - Download data

Policies Permissions

  • policies.view - See policy list
  • policies.create - Create new policies
  • policies.edit - Modify policies
  • policies.delete - Remove policies
  • policies.enable - Toggle on/off

Example Custom Roles​

Security Analyst

Name: Security Analyst
Permissions:
  - alerts.view
  - alerts.acknowledge
  - alerts.resolve
  - activity.view
  - activity.export
  - policies.view
  - clients.view

Policy Admin

Name: Policy Admin
Permissions:
  - policies.*  # All policy permissions
  - alerts.view
  - clients.view
  - integrations.view

Assigning Roles​

When Inviting​

  1. Click Invite Admin
  2. Enter email
  3. Select role from dropdown
  4. Send invitation

Changing Roles​

  1. Go to Settings > Admins
  2. Click admin to edit
  3. Change role assignment
  4. Save changes

Team-Based Permissions​

Enterprise

Scope permissions to specific teams:

Team Scoping​

  • View only their team's data
  • Manage only their team's users
  • See only team-related alerts

Configuration​

  1. Create team in Clients > Teams
  2. Assign admin to team
  3. Enable team scoping on role
  4. Admin sees only team data

Permission Inheritance​

Role Hierarchy​

Owner
  └── Administrator
        └── Analyst
              └── Viewer

Higher roles include all permissions of lower roles.

Override Permissions​

Custom roles can override inheritance:

  • Grant specific permissions
  • Deny inherited permissions
  • Create unique combinations

Auditing Permissions​

View Permission Changes​

  1. Go to Activity
  2. Filter: event_type:permission
  3. See all permission changes

Audit Information​

Each change records:

  • Who made the change
  • What changed
  • When it changed
  • Previous state

Best Practices​

Least Privilege​

  • Grant minimum necessary permissions
  • Review permissions regularly
  • Remove unused access

Role Design​

  • Create roles for job functions
  • Avoid too many custom roles
  • Document role purposes

Regular Review​

  • Quarterly access reviews
  • Check for permission creep
  • Remove stale access

Troubleshooting​

Permission Denied​

  1. Check assigned role
  2. Verify required permission
  3. Check team scoping
  4. Contact admin for access

Can't Assign Role​

  1. Verify you have admin permissions
  2. Check role exists
  3. Confirm user is active
  4. Try refreshing page

Custom Role Issues​

  1. Review permission list
  2. Check for conflicts
  3. Verify role is saved
  4. Test with test user