Assigning access

The people on this page are your application's end users, the ones in your directory: they sign in to your product, never to this Workspace. Granting your own staff authority happens on the Administrators page, not here. An identity on its own can sign in and do nothing. Access comes from an assignment: one person, one role, at one place. Until someone makes that assignment, being in the directory means only that the person exists.

Three things together, and all three matter. A fourth is optional.

You cannot hand out every role that exists, only the ones your own role permits. An account administrator decides that list when they compose your role, which is what stops assignment becoming a way of granting more authority than you hold. If a role you expect is not offered, it is not that the role is missing: it is not one of yours to give. Two people are exempt, and hold the whole list: the account owner, and anyone granted authority over every Environment.

An assignment can be changed after the fact: a different role, a different window, or both. Its place is fixed when it is made, so putting someone's role somewhere else means removing this assignment and making another. Removing takes the role away at that place and nothing else: the person stays in the directory, keeps any other roles they hold elsewhere, and can be assigned again later. Neither is a deletion of the person.