Access Control

Ordyn uses fixed roles and scoped user groups for normal access control.

Administrators do not create custom roles or assign individual permissions directly. Instead, Ordyn provides a fixed set of product roles. Each role grants a maintained set of product capabilities.

User Groups

Users receive access through user groups.

A user group can have one or more scoped role assignments. Each assignment combines:

• a fixed role
• a tenant
• optionally, a folder inside that tenant

When a folder is selected, the assignment applies to that folder and the resources below it. When no folder is selected, the assignment applies to the whole tenant.

Users

Users are managed from the user management area.

Administrators can:

• create users
• edit user display details
• assign users to user groups
• remove users that should not have access

Users without a role assignment can sign in, but they only see the limited access page because no product area is available to them.

When a user account is deleted, new automated work does not depend on that user account continuing to exist. Audit and history entries keep the recorded actor name for past actions.

Fixed Roles

Fixed roles are maintained by Ordyn and are updated with the product.

The available roles are:

Role	Purpose
Endpoint Viewer	Read endpoint and endpoint-group information.
Endpoint Operator	Operate endpoints and run common endpoint actions.
Job Operator	View, run, and abort jobs.
Job Designer	Create and maintain jobs, scripts, and supporting job assets.
Software Manager	Manage packages, software products, update policies, and software inventory reports.
OS Deployment Manager	Manage OS images, driver profiles, agent releases, and enrollment assets.
Service Operator	Manage service clients and service infrastructure integrations.
Security Auditor	Inspect audit, history, configuration, and inventory data without operational mutation rights.
Access Manager	Create, update, and delete users; manage user groups and fixed-role assignments.
Platform Admin	Perform all normal permission-gated operations.

Fixed roles can be assigned to different tenants or folders through user groups. This allows the same role to grant broad access in one tenant and narrow access in another.

Super Admin

Super admin access is separate from fixed roles.

A super admin bypasses normal role and scope checks. This is stronger than the Platform Admin role, which still works through the normal permission system.

Use super admin access only for trusted platform owners, initial setup, and break-glass recovery. For daily administration, prefer fixed roles assigned through user groups.

Practical Guidance

Use the smallest role and scope that match the user's work.

Examples:

• give helpdesk users Endpoint Operator on the folders they support
• give automation maintainers Job Designer on the tenants they manage
• give software owners Software Manager on their tenant
• give security staff Security Auditor when they need broad investigation access
• reserve Access Manager for people who administer users, user groups, and access assignments
• reserve super admin for people who must be able to recover or administer the whole platform