Users, roles, and permissions

Overview

ToBeAlert uses role-based access control (RBAC). User accounts live under Users; roles and permission strings live under Roles.

Concept	Documentation
User accounts — create, edit, enable, password reset	Users overview · Managing users
Roles — built-in, custom, match patterns	Roles overview · Creating and managing roles
Permission labels in the UI	Permissions reference
Alert visibility (separate from permissions)	Views

Role-based access control

Users sign in with a login and receive one or more roles. Each role bundles permissions that control menus, actions, and data access. Views limit which alerts appear on the dashboard; permissions control what users can do with those alerts.

Built-in roles

ToBeAlert ships admin, user, and guest — see Built-in roles. Built-in roles cannot be deleted or edited from the UI.

Custom roles

Administrators create custom roles under Access Control → Roles (/roles). For the create/edit workflow, KPI scope, match patterns, and bulk actions, see Creating and managing roles.

Permission reference

Every value in the Permissions dropdown is listed in Permissions reference, grouped by product area (alerts, policies, tools, instructions, API keys, and others).

Permission levels

Level	Description
read:*	Basic viewing permissions
write:*	Ability to create and modify
admin:*	Full administrative control

Global admin grants broad access across the product. See Permission levels for standalone entries such as read and write.

Best practices

1. Follow the principle of least privilege — grant only the permissions each role needs.
2. Create role templates — standardize roles for common job functions; use descriptive names (noc-operator, not role2).
3. Pair roles with views — permissions control actions; views control alert visibility.
4. Regularly audit access — review user roles and Last login on the Users page.
5. Document your permission structure — maintain a runbook that maps teams to roles and views.

Related documentation

Topic	Documentation
Views (alert visibility)	Views overview
External auth	External auth providers
API keys (same permission labels)	API Keys

Integration with authentication systems

ToBeAlert can integrate with LDAP/Active Directory and SAML-based SSO for centralized sign-in and optional group-to-role mapping. See External auth providers. Directory group mappings can assign views and roles automatically after sync or at login.