Users, Roles & Permissions

Users, Roles & Permissions

Every member of your organization has an access level for each environment and, optionally, admin rights. The access level is also the seat: it decides what the user can do and how the user is billed. This page explains the roles, how to invite and manage users, and where the permission boundaries are.

Access Levels

A user’s access level is set per environment:

Access level	What it unlocks
None	No access to this environment.
Portal Viewer	Free, limited access to shared portal content.
Process Foundation	Model and dashboard viewing, plus process modeling and editing.
Process Architecture	Everything in Process Foundation, plus advanced process modeling.
Process Intelligence	All access levels, plus Process Intelligence features and dashboard creation.

• The access level is the seat: it determines capabilities and billing. Portal Viewer is free; the other seats are paid and are billed from the moment the seat is assigned. Accepting the invitation is not required for billing.
• Access is stored per environment. The organization user list shows the highest active role across the organization’s environments.
• The View analytics switch grants read-only access to dashboards. Paid access levels have it on by default; free Portal Viewer seats can open analytics only in Enterprise organizations.

Admin Rights

Admin rights are separate from the access level — they grant settings access, not model access:

• Org. Admin — manages the whole organization: all environments, organization settings, users, and plans.
• Admin (environment admin) — manages one environment: its users, theme, company profile, and architecture settings.

A user can be an admin without an access level. Such admin-only users can manage settings, but they cannot open the catalog, models, dashboards, or documents.

Inviting Users

Users are managed in two places under Settings:

• Organization → Users (the All Users screen) — all members of the organization, with an environment selector to focus on one environment.
• Environment → Users (the Environment Users screen) — the members of the current environment.

To invite someone new:

1. Open Settings → Organization → Users and click Add New User. With an environment selected, the button reads Add member to environment.
2. Fill in first name, last name, and email, choose a Default Environment and the Access Level, and set the View analytics and Admin switches as needed.
3. Leave Send Invitation email on (it is on by default). The user receives an invitation email with an accept link and signs in with Microsoft, Google, or LinkedIn.
4. Until the invitation is accepted, the user shows as Waiting on acceptance in the list.

To add someone who is already a member of the organization to another environment, use the environment selector on the organization screen and pick them under Add (existing) users… — no new email is sent.

Managing Users

• Edit — open a user to change name, access level, or switches in the User Profile panel.
• Resend an invitation — use Send Invitation email on the user’s row.
• Deactivate — switch Active off to block login while keeping the user’s history. Only active users can log in.
• Remove from an environment — Remove user from this environment on the environment screen.
• Remove from the organization — Remove this user from the organization; this also removes the user from every environment.

You cannot remove or de-admin yourself; another admin has to do it.

What Each Role Can Do

Action	Required role
View the catalog, models, and documents	Portal Viewer or higher
Edit models	Process Foundation seat or higher
Create dashboards and run simulations	Process Intelligence
Manage environment settings	Environment admin or org admin
Manage organization settings, users, and billing	Org admin
Open portal content	Portal Viewer

For the portal side of viewer access, see Viewer Users. For seat management and billing, see Billing and Payments.

Related topics

• Viewer Users: what people with portal access can see.
• Billing and Payments: seats, plans, and invoices.
• Organization Settings: organization-level configuration.
• Environments (Tenants): how workspaces are separated.
• Single Sign-On (SSO): how invited users sign in.

Frequently asked questions