Role-Based Access Control

Overview

Role-Based Access Control (Admin → Security → RBAC, /admin/security/rbac) decides what each person can see and do. A permission allows one kind of action, for example assets:read or scans:write. A role is a named set of permissions. People get permissions only through the roles they hold, and a person who holds several roles has every permission of all of them.

DeviceQuest has one built-in system role, admin. It holds every permission, and DeviceQuest adds new permissions to it automatically when they are introduced. You can’t rename, edit or delete it. Every other role is a custom role that you create, edit, clone and delete as you need, for example a read-only auditor role or an analyst role.

Viewing roles needs roles:read. Creating and editing roles, changing members and changing the MFA requirement need roles:write. Deleting roles needs roles:delete.

Screen tour

Click to enlarge

Each row shows the role’s Role name and description, its Class, a Permissions bar with the permission count, how many Members hold it, an MFA badge when MFA is required, and when it was Updated. The Permission mix legend explains the bar’s colours:

Click a row to open the role in a side panel. The filters, sort order, open role, open tab and open dialog are kept in the address bar, so you can share a link to a role or to a filtered list. A banner such as “2 new roles since your last visit” points out roles created since you last opened the page; click × to dismiss it.

Role details

Click to enlarge

The side panel’s title shows the role name and the start of its ID. Every role also has a page of its own at /admin/security/rbac/<role ID>, with the same hero and tabs and a Back to RBAC link; the Roles summary on Users links there.

• Overview lists the Role ID, Class, number of Permissions and Members (click either to jump to its tab), MFA required, Created and Updated, and the role’s top five Permission categories with a count each.
• Permissions shows and edits the role’s permissions. See Change a role’s permissions.
• Members lists who holds the role. See Manage members.
• History lists every change to the role: who made it, what it was (created, updated, deleted, user assigned, user removed or MFA policy updated), when, the recorded details and the IP address. Choose Last 7d, Last 30d, Last 90d or All time, and click Load more for older entries. Click a details block to expand it.

Create a role

Click to enlarge

1. Click New role (or press n).
2. Enter a Role name and, optionally, a Description.
3. Tick the Permissions the role needs. Use the permission reference and the page access table to choose.
4. Click Create role.

The new role appears under Custom roles with “Role “name” created”. Give it to people from its Members tab, from User details, or when you invite them.

Grant only what the role needs. For a read-only role, pick the :read permissions of the areas people must see. Add a :write, :delete or :admin permission only for the areas where they act.

Clone a role

Cloning is the quickest way to make a variant of an existing role, including admin.

1. Click Clone in the role’s hero, or Clone role on its row (or press c).
2. In Clone “role”, change the New role name. It starts as “Copy of role”.
3. Adjust the Description and the ticked Permissions. All of the source role’s permissions start ticked.
4. Click Clone role.

The clone is a new custom role with no members.

Edit a role

1. Click Edit in the role’s hero, or Edit role on its row (or press e).
2. Change the Role name or Description.
3. Click Save.

The system role admin opens in a read-only View role dialog that says “System roles cannot be renamed.”

Change a role’s permissions

Click to enlarge

1. Open the role and select the Permissions tab.
2. Tick permissions in Full catalog to add them, and untick them in either list to remove them.
3. Click Save.

DeviceQuest confirms with “Permissions updated”. Everyone holding the role gets the new permissions. The admin role’s permissions are fixed: its tab says “System role permissions cannot be modified. View them in the catalog below.”

Delete a role

1. Click Delete in a custom role’s hero, or Delete role on its row (or press d).
2. Read the dialog. It tells you how many members the role has; they lose every permission the role grants.
3. If the role has members, type the role name in Type name to confirm.
4. Click Delete role, or Cancel.

DeviceQuest confirms with “Role deleted”. When you delete a role from its own page, you return to the role list.

You can’t delete admin, and you can’t delete a role while a pending invitation uses it: DeviceQuest says “cannot delete a role with a pending invitation; revoke the invitation first”. Revoke the invitation on Users first.

Require MFA for a role

When a role requires MFA, everyone who holds it must use multi-factor authentication. People who aren’t enrolled yet are asked to enroll at their next sign-in.

1. Open the role.
2. Click the MFA required switch.
3. Read the dialog. Enable MFA requirement says “Users holding the “role” role will be prompted to enroll in MFA on their next login.” Disable MFA requirement says they will no longer be required to have MFA enrolled. Both apply to everyone currently holding the role.
4. Click Enable MFA or Disable MFA, or Cancel.

You can set the requirement on admin too. For an overview of enrollment across roles, and to help people who aren’t enrolled, see MFA policy.

Manage members

Click to enlarge

Add people to a role

1. On the Members tab, click Add users.
2. In Assign users to “role”, search with Search by email or name… and tick the people to add. People who already hold the role aren’t listed.
3. Click Assign N users.

Remove people from a role

• To remove one person, click the remove icon on their row and confirm with Remove. If it’s your own account, the dialog warns “Warning: you are removing yourself from this role.”
• To remove several people from a custom role, tick them, click Remove N, optionally pick a Reason (Left organisation, Role no longer needed, Compliance review or Other) and add Notes, then click Remove N users.

DeviceQuest always keeps at least one active admin: you can’t remove your own admin role, and you can’t remove admin from the last active admin. See At least one admin must remain.

Act on several roles

Tick roles in the list to show the bulk bar at the bottom of the page:

• MFA policy: Require or Make optional sets the MFA requirement on every selected role, and reports how many roles changed.
• Export N: downloads the selected roles as rbac-roles.csv.
• Delete N: deletes the selected custom roles after you confirm with Delete roles. It is unavailable while admin is selected.
• ×: clears the selection.

Export roles

Export in the toolbar, or Export N in the bulk bar, downloads rbac-roles.csv with one row per role and the columns ID, Name, Description, Class (system or custom), Permission Count, User Count, Requires MFA (yes or no), Created and Updated.

Fields

Statuses

Permission reference

These are all the permissions in DeviceQuest, grouped by area as the permission pickers show them. The admin role holds all of them.

Administration and security

Assets and discovery

Risk

Cloud

Govern

Dashboards, views and automation

Integrations

Which page needs which permission

To open a page, a person needs at least one of the permissions listed for it. Without one, DeviceQuest shows an Access restricted page instead (see Signing in). A rule also covers every page below its path, for example /assets/<id>. Actions inside a page can need more, typically the matching :write, :delete or :admin permission.

Pages that aren’t listed, such as your profile and MFA Settings, are open to every signed-in user.

Keyboard shortcuts

These work on the role list when you aren’t typing in a field.

Related pages

• Users and invitations
• User details
• MFA policy
• Audit log
• Signing in