Access
Access is the area of the Studio for the people and applications that may use a tenant: users, roles, groups and OAuth clients. Select Access in the rail to open it. The area is shown to accounts with the role UserManagement.
Tabs
| Tab | Required role | Description |
|---|---|---|
| Users | UserManagement | Manage user accounts and credentials |
| Roles | UserManagement | Define and manage roles |
| Groups | UserManagement | Organize users and assign roles via groups |
| Clients | UserManagement | Configure OAuth client applications |
Two related pages are not in Access but in Settings: the identity providers and the e-mail rules for sign-in (Settings > Sign-in), and the provisioning of administrators of a child tenant (Admin provisioning, Settings > Tenant > Child tenants).
Concepts
Authentication vs. Authorization
- Authentication verifies who a user is — handled by the sign-in methods of the tenant (local login, Google, Azure AD, LDAP, etc.; set up under Settings > Sign-in)
- Authorization determines what a user can do — handled by roles and groups
Role-Based Access
OctoMesh uses role-based access control (RBAC). Every action in the platform is gated by one or more roles. Users receive roles either through direct assignment or through group membership.
Groups and Role Inheritance
Instead of assigning roles to each user individually, you can create groups with roles and add users to those groups. This is the recommended approach for managing permissions at scale.
Group "Engineering"
├── Roles: Development, CommunicationManagement
├── Members: alice, bob, charlie
└── Child Group: "Engineering Leads"
├── Roles: TenantManagement
└── Members: alice
In this example, alice receives Development, CommunicationManagement, and TenantManagement. bob and charlie receive Development and CommunicationManagement.