Roles & permissions

Access in Stratforge One is built from a few simple pieces. Roles decide what a person can do inside an app, groups let you manage many people at once, and data policies decide what data a person can see. This page explains roles, permissions, and groups, and how you grant and review access. Data policies have their own page - see Data policies.

A role is a named bundle of permissions, scoped to one app.
A permission is a single action on a module (for example, delete on Conversations).
You assign roles to users to grant actions.
You put users into groups to assign data policies in bulk.

Roles and permissions: what someone can do

Roles and permissions are per app. Each Stratforge product (such as Redflare or Discover) exposes its own set of modules, and each module exposes its own permissions, so a role is always scoped to a single product.

You manage them from Apps → (your app) → Manage → Access Controls. The screen is a master-detail editor: a searchable list of roles on the left, and the permission editor for the selected role on the right.

Modules and permissions

A module is an area of the product - for Redflare these are Conversations, Agents, Dashboards, Workflows, Alerts, and Integrations; for Discover they are Datasets, Reports, and Explorations. Each module declares its own permissions (the verbs you can grant), for example:

View list - see the module's list of items, including its menu entry.
View - see individual items and their details.
Create, Edit, Delete - manage items in the module.
Module-specific verbs such as Process / Re-process and Export on Conversations, Publish on Workflows, Acknowledge on Alerts, or Connect / Disconnect on Integrations.

Granting or revoking one permission never implies or clears another. View list gates a module's list (its menu entry) and View gates individual items, but neither depends on the other - you grant exactly what you intend.

System and custom roles

Roles come in two kinds, shown grouped in the list:

System roles (such as QA, Agent, and Manager) are seeded for you. You can edit their permissions, but their name and description are read-only and they cannot be deleted.
Custom roles are ones you create. You can rename them, edit their description and permissions, and delete them.

Creating a role

Go to Apps → (your app) → Manage → Access Controls.
Select New role.
Give it a name and an optional description.
Optionally clone permissions from an existing role to start from its grants, or start from scratch with nothing granted.
Create the role - it opens in the editor, ready for you to adjust permissions.

Editing permissions

The editor shows one card per module, with a pill for each permission. Click a pill to grant or revoke it. Each module also has a Select all / Clear all shortcut and a running count of how many of its permissions are granted.

As you make changes, pills you have just granted or revoked are highlighted so you can see your pending edits before committing them, and an Unsaved changes note appears. Select Save changes to apply, or Discard to revert. If you try to switch to a different role with unsaved edits, Stratforge One asks you to confirm before discarding them.

Groups: managing people in bulk

A group bundles users together so you can assign data policies to many people at once instead of one by one. Groups are organization-wide (not tied to a single app) and live under Directory → Groups.

Each group has:

A name and an optional description.
An owner - the person who created it. Only the owner can rename the group, edit its description, manage its membership, or delete it. Everyone else sees it read-only.
Members, each marked with their source: Manual (added by hand) or Synced (synced from your identity provider). The owner is always a member and cannot be removed.

Groups are the unit you assign data policies to. Every member of a group inherits the union of the data policies assigned to that group. Roles, by contrast, are assigned to users directly, not through groups.

Creating and managing a group

Go to Directory → Groups and select New Group.
Give it a name and description, then create it.
Open the group to manage it. From the detail page you can:

Rename the group or edit its description inline (owner only).
Add members with the user picker, or remove a member (owner only).
Assign data policies to the whole group - see Data policies.

If you build up more than 100 groups, Stratforge One nudges you to consolidate them so membership stays easy to manage.

Granting access, end to end

To give someone what they need:

Decide what they can do. Pick or create a role for the app and set its module permissions under Access Controls.
Assign the role to the person. Open the user in Directory → Users, go to their Roles section, and assign one or more roles. A user's effective permissions are the union of every role they hold.
Decide what data they can see. Assign a data policy to the user, or add the user to a group that already has the right policies. See Data policies.

Reviewing access

Per role - the Access Controls editor shows, for every module, how many permissions are granted versus not, so you can audit a role at a glance.
Per user - a user's detail page in the Directory lists the roles they hold and the data policies that apply to them (both directly assigned and inherited from their groups).
Per group - a group's detail page lists its members and the data policies every member inherits.

How access is scoped

Mechanism	Scope	Where you manage it
Roles & permissions	Per app (product)	Apps → (app) → Manage → Access Controls
Role assignments	Per user	Directory → Users → (user) → Roles
Groups	Organization-wide	Directory → Groups
Data policies	Per app (product)	Apps → (app) → Manage → Data Policies

Roles and data policies are always tied to one product, so a role or policy you create for Redflare does not affect Discover. Groups are shared across the whole organization and can hold policies from more than one app.

Roles & permissions

On this page