Historically, user access within our platform was managed at the organization level. Each organization could contain multiple users and projects, and any user belonging to an organization had implicit access to all projects under that organization. Access control was limited to a basic set of account-level roles:

  • Admin
  • Member
  • Billing

These roles were not customizable and applied uniformly across all projects within the organization.

What’s Changing

To better support multi-tenant structures, team separation, and granular permission management, we are introducing a new project-level roles and permissions system, alongside improvements to role customization.

Key Enhancements

✅ Project-Level Membership

  • Users now only belong to projects they are explicitly assigned to.
  • Belonging to an organization does not automatically grant access to all projects.
  • Enables organizations to split users across cost centers, tenants, or teams more securely and cleanly.

✅ Separation of SSO and Access Control

  • Organizations maintain centralized SSO/login access, but authorization is project-specific.
  • Users sign in through their organization, but only see and manage the projects they are assigned to.

✅ Granular Project Roles

  • Introduction of Project Roles, independent from Account Roles.
  • Project roles control access and actions within each individual project.

✅ System Roles

  • We provide three predefined system roles:
    • Admin – Full control over project
    • Member – General management access
    • ReadOnly – View-only access
  • These system roles come with preset permissions, which cannot be edited directly.

✅ Custom Roles

  • Organizations can create custom project roles, based on one of the system roles.
  • Custom roles allow for fine-tuning permissions, such as removing the ability to terminate services for Members.
  • Example: Create a MemberV2 role that mirrors Member but with restricted service management.

✅ Account Role Context

  • Account roles (Admin, Member, Billing) still exist and act as organization-level roles.
    • Admin – Full organization control (including all projects by default)
    • Member – Limited organizational privileges
    • Billing – Access to billing-related data only
  • By default, an account role sets the user's project role automatically, but this can be overridden per project.

Portal UI Changes

To support this new model, the portal interface is being updated to reflect improved management capabilities:

Organization Management Screen

  • View and edit organization-level roles
  • View user access across all projects

Project Management Screen

  • Assign or remove users from specific projects
  • Set or change project roles
  • Create and manage custom roles
  • Enforce role-based permission visibility in the UI

Behind-the-Scenes Logic

  • The portal dynamically shows or hides features and actions based on the user’s effective project role.
  • Permission checks are enforced both in the UI and at the backend level to ensure security.