Roles and Permissions

The platform has 4 roles for organization members, giving admins fine-grained control over who can see and change what.

Roles

Role	Purpose
Admin	Full control over the organization — settings, team, monitored entities, integrations, billing, all analyst capabilities
Analyst	Security-team member — investigates findings, acknowledges alerts, tunes rules, runs scans. No team/billing control
Viewer	Read-only observer — can look at findings and reports but cannot change alert state or configuration
Employee	Regular staff member — sees only their own findings on the dashboard and reads company policies. No analyst surfaces

Superuser is a platform-level role (not per-organization) reserved for the ByteCode team. It bypasses all role checks.

Permission matrix

Capability	Admin	Analyst	Viewer	Employee
View
Dashboard	✅	✅	✅	✅
Own alerts and detections	✅	✅	✅	✅
Reports	✅	✅	✅	✅
Policies tab	✅	✅	✅	✅
Your Studies (training)	✅	✅	✅	✅
Monitoring landing	✅	✅	✅	✅
Alert workflow
Acknowledge / resolve alert	✅	✅	❌	❌
Alert rules page	✅	✅	❌	❌
Scanning
Save scan schedule	✅	✅	❌	❌
Run scan now	✅	✅	❌	❌
Manage monitored entities (domains, repos, employees)	✅	✅	❌	❌
Team management
Invite new users to the organization	✅	❌	❌	❌
Assign / change user roles	✅	❌	❌	❌
Remove users from the organization	✅	❌	❌	❌
Integrations (organization-wide)
Connect Notion Policies	✅	❌	❌	❌
Set Education platform URL	✅	❌	❌	❌
Configure Slack notifications	✅	❌	❌	❌
Own accounts
Connect own GitHub / GitLab / Microsoft SSO	✅	✅	✅	✅
Edit own profile	✅	✅	✅	✅
Organization-level
Audit log	✅	❌	❌	❌
Change organization name and settings	✅	❌	❌	❌
Billing and subscription	✅	❌	❌	❌
Delete organization	✅	❌	❌	❌

How to assign a role

Admins assign the role at invite time and can change it later.

At invite

1. Company profile → Add Team Member.
2. Enter the person's email.
3. Pick the role from the dropdown: Employee (default) / Viewer / Analyst / Administrator.
4. Add. The person will sign in with their configured SSO (Google or Microsoft) and see the platform through their role.

Changing an existing member's role

1. Company profile → team list.
2. Find the user → click on their current role.
3. Pick the new one.
4. Save.

Every role change is recorded in the Audit log.

Choosing the right role

Rule of thumb: least privilege by default. When in doubt, start people at Employee and elevate on request.

• Admin — security lead, IT lead (typically 1-3 per organization).
• Analyst — SOC team, incident responders, anyone who investigates findings and manages alerts day-to-day.
• Viewer — auditors, board observers, contractors who need visibility without touching anything.
• Employee — every other staff member. They see the platform to review their own exposure (leaked credentials tied to their email, secrets they might have accidentally pushed) and to read company policies.

Employee experience

Employees log in and see the same dashboard as everyone else — but scoped to their own findings only. They cannot:

• open the Alert rules page,
• acknowledge / resolve alerts,
• run manual scans or edit the scan schedule,
• see analyst-only APIs.

They can:

• see leaks and secrets tied to their identity,
• read company policies,
• open the linked education / training platform,
• update their own profile and connect their own GitHub / GitLab / Microsoft accounts for scanning.

The first user

Whoever creates the organization automatically gets the Admin role. They invite others and assign roles.

If the only Admin leaves the company — before removal, someone else must be promoted to Admin, otherwise the organization is left without management. If this already happened, contact aw@bytecode.team.