Users reference
Local users, roles, passwords, SSO, SCIM provisioning, and user groups.
Cet article n’a pas encore de traduction vérifiée. Le texte anglais est présenté pour préserver les commandes et étapes opérationnelles.
The User Management page controls who can use the admin surface.
Local users#
- Add / update - create users, assign roles, set passwords, and mark accounts active or inactive.
- Remove - delete users, with self-delete and last-admin protection.
- Passwords are stored as salted hashes (PBKDF2).
Roles#
| Role | Access |
|---|---|
| Admin | Full access to everything |
| Read-Only | View the entire UI, all mutations blocked |
| AI-FW Admin | Manage the AI firewall surface only |
| Agent-Trust Admin | Manage the agent inventory and trust only |
SSO & provisioning#
- OIDC SSO - provider configuration (authority, client ID, secret, scopes,
callback), sign-in mode (
local,oidc, orboth), and a runtime role map. Unknown or absent claims map to Read-Only. - SCIM 2.0 - enable with a bearer secret; users and groups provision from your identity provider, with roles assigned from matching groups.
User groups#
Named groups of users (local usernames and/or OIDC email or UPN) that share one or more roles. Members inherit the group's roles at sign-in; the effective role is the user's own role plus their groups' roles. Group changes apply on the next sign-in and all mutations are audited.
See Identity & access.