Roles and permissions
Lumen Edge has two levels of role, and understanding the split is the key to granting access correctly.
Global roles
A global role grants permissions across the whole deployment — managing tenants, managing users, editing deployment settings. Global roles are for platform administrators.
Tenant roles
A tenant role grants permissions within one tenant — viewing assets, running scans, generating reports in that tenant only. A user is assigned tenant roles per tenant, so the same person can be an administrator in one tenant and read-only in another.
Holding a global role does not by itself grant visibility into a tenant's assets. Access to tenant data is granted by assigning a tenant role for that tenant.
Permissions
Each role holds a set of permissions, stored as an access mask — a bitmask where each bit is one capability. In the console this is presented as a checklist per resource; the mask is an implementation detail you only meet in the API.
Create and edit roles under System management → Roles, choosing whether the role is global or tenant-scoped, then selecting its permissions.
Enumerate the permission bits per resource, and document which permissions the built-in roles carry.
Designing role assignments
A workable default for most deployments:
| Role | Scope | For |
|---|---|---|
| Platform administrator | Global | Managing tenants, users and deployment settings |
| Tenant administrator | Per tenant | Full control of one tenant's configuration |
| Analyst | Per tenant | Running scans, working findings, generating reports |
| Read-only | Per tenant | Viewing inventory and reports; no changes |
Because tenant roles are per tenant, there is rarely a reason to hand out a global role. Reserve global roles for the small number of people who genuinely administer the platform itself.
See also
- Tenants and users — assigning these roles
- API authentication — how permissions are enforced on API calls