Settings, Users & RBAC

This page is the map of the Settings area in the Tenant Plane (TP). For step-by-step user and role procedures, see Users, roles & access. For two workflow systems (ITSM approval vs automation), see Workflows (ITSM vs automation).

Where to find settings

Open Settings from the sidebar. Everything below is tenant-scoped.

Users & access (summary)

• List users — GET /api/users (requires users:read or rbac:manage).
• Invite — POST /api/auth/invite; invitee completes signup-exchange. Today the exchange path typically grants admin; for least privilege use SSO group mapping or SCIM (documented in the full access guide).
• Deactivate — PATCH /api/users/[id] with active: false.

There is no role dropdown for every user in Settings yet — role changes at scale go through IdP groups → roles or SCIM.

Roles & permissions (summary)

• Roles (admin, operator, fulfiller, requester, …) bundle permissions.
• APIs enforce flat permissions (requirePermission) and scoped resource checks (requireScopedPermission, requireTenantScopedPermission).
• Portal behavior (requester vs fulfiller shortcuts) is described in Self-service portal.

Approval gates (runbook / automation)

These gates control when automation may run (policy / autonomy / trust stack), distinct from ITSM approval workflows on service requests:

• Per runbook or step — Some executions require human approval before continuing.
• Autonomy level — Higher autonomy can reduce manual approval when policy allows (see AI trust & autonomy).
• Who can approve — Users with rights to approve automation jobs / runbook execution (see Automation and Runbooks).

ITSM human approval chains use /api/workflows/definitions + workflow instances — not the same as the Automation → Workflows canvas. Details: Workflows (ITSM vs automation).

Integration tokens

Create and revoke tokens for scripts and integrations; store secrets outside the repo. See your deployment’s Settings → Integration tokens or connector docs.

TP vs Control Plane

Summary

See also

• Subscribe & get access
• ITSM module