帮助 · 32
Roles
What owners, admins, operators, approvers, auditors and viewers can do in a company, and who needs two-factor.
Each person in your company has one role. The role decides what they can see and do. Give each person the smallest role that fits their work; you can change it any time in Members & roles.
Company roles
| Role | Can do |
|---|---|
| Owner | Everything, including billing, the administration keys, A-REX support access and who can approve what automations propose. Gives the approval for changes to the administration account. |
| Admin | Everything except billing: members, settings, integrations, publishing automations, approvals. |
| Operator | Reads everything, registers harvests, deliveries, processing and certificates, gives approval to what others send, manages the directory, runs reports, uses the assistant, drafts automations. |
| Approver | Reads everything and gives approval to what others propose; never creates anything. The second pair of eyes. |
| Auditor | Reads everything including the audit log, runs reports, uses the assistant. Cannot change anything. |
| Viewer | Reads lots, approvals and records. Cannot change anything. |
Nobody can approve what they asked for themselves, except an owner on something they asked for in the console. See Who can approve.
Two-factor
Owners, admins, operators and approvers must use an authenticator app, and every approval asks for a fresh code. Your company can require two-factor for every member in Members & roles.
Partners
People from another company, such as a producer, a buyer or a lab, can be invited to the partner portal from their party's page. They are guests, not members: they see only the lots they sent or received, their origin and certificates, and nothing else of yours.
Organization roles
When your organization has several companies, people also have an organization role:
- Owner and Admin are admins of every company, unless a company turns that off. They also add companies and sandboxes to the organization.
- Billing manages the plan and invoices, and sees no company data.
- Member opens only the companies they were added to.
Machines and the assistant
API keys, machine clients, automations and the assistant can read and propose, within the permissions they were given, but none of them can approve. Approval always needs a person.