User Roles and Permissions

GeoHazardWatch implements a role-based access control (RBAC) system that defines what actions users can perform within the GeoHazardWatch . This system provides fine-grained permission control while maintaining simplicity for Administrator.

Your Current Roles and Permissions

Current User Summary

Your roles and permissions

Login Status

Not Authenticated We recognize you but you are not currently authenticated. Login to access all features.

User Information

Username:	`Anonymous`
Display Name:	Anonymous User

Your Roles

Anonymous System
Public access without authentication

Your Permissions

Permission	Granted By Role(s)
`asset-read` View assets (attachments)	Anonymous
`page-read` View pages	Anonymous
`search-page` Search pages	Anonymous

Total Roles: 1 | Total Permissions: 3

Available Roles and Permissions

Roles and the Permissions each Role are defined in Configuration System as Access Control Policies

Available Roles

System and user-defined roles

Role Name	Display Name	Description	Type
`admin`	Administrator	Full system access to all features	System
`anonymous`	Anonymous	Public access without authentication	System
`contributor`	Contributor	Can create and edit pages	System
`editor`	Editor	Can create, edit, delete, and rename pages	System
`reader`	Reader	Read-only access to content	System
`user-admin`	User Administrator	Can manage users — create, edit, deactivate, delete	System
`vault-owner`	Vault Owner	Everything inside your own vaults — pages and files: read, create, edit, rename, delete, upload, share by link. Applies only in vaults you own; not deleting a vault. Given to every account (#1539)	System
`demo-admin`	Demo Administrator	Read-only access to the admin dashboard. For public demo instances: can view every admin screen but change nothing, and cannot see the user list.	Custom

Total Roles: 8 | System Roles: 7 | Custom Roles: 1

Permission Categories

Available Actions (Permissions)

All unique actions defined in access control policies

Category	Actions
`account-security`	`account-security`
`admin-read`	`admin-read`
`admin-roles`	`admin-roles`
`admin-system`	`admin-system`
`asset-delete`	`asset-delete`
`asset-edit`	`asset-edit`
`asset-read`	`asset-read`
`asset-upload`	`asset-upload`
`audit-export`	`audit-export`
`comment-create`	`comment-create`
`config-manage`	`config-manage`
`identity-manage`	`identity-manage`
`identity-read`	`identity-read`
`media-read`	`media-read`
`page-create`	`page-create`
`page-delete`	`page-delete`
`page-edit`	`page-edit`
`page-export`	`page-export`
`page-public`	`page-public`
`page-raw-edit`	`page-raw-edit`
`page-read`	`page-read`
`page-rename`	`page-rename`
`profile-manage`	`profile-manage`
`proxy-grant`	`proxy-grant`
`search-page`	`search-page`
`search-user`	`search-user`
`secret-reveal`	`secret-reveal`
`session-revoke`	`session-revoke`
`share-create`	`share-create`
`share-extend`	`share-extend`
`share-revoke`	`share-revoke`
`store-create`	`store-create`
`token-extend`	`token-extend`
`token-mint`	`token-mint`
`user-create`	`user-create`
`user-delete`	`user-delete`
`user-edit`	`user-edit`
`user-read`	`user-read`
`vault-proxy`	`vault-proxy`

Total Actions: 39 | Categories: 39

Display All Actions (Permissions)

* account-security
* admin-read
* admin-roles
* admin-system
* asset-delete
* asset-edit
* asset-read
* asset-upload
* audit-export
* comment-create
* config-manage
* identity-manage
* identity-read
* media-read
* page-create
* page-delete
* page-edit
* page-export
* page-public
* page-raw-edit
* page-read
* page-rename
* profile-manage
* proxy-grant
* search-page
* search-user
* secret-reveal
* session-revoke
* share-create
* share-extend
* share-revoke
* store-create
* token-extend
* token-mint
* user-create
* user-delete
* user-edit
* user-read
* vault-proxy

Role Assignment

Current Role Assignments

Current User Assignments are available at Security Policy Management (admin permission required)

Security Policy Summary

Permissions matrix showing which roles have which permissions, derived from the access policies

Permission	Administrator	User Administrator	Editor	Contributor	Demo Administrator	Vault Owner	Reader	Anonymous
`page-read` View pages
`page-edit` Edit pages
`page-public` Make a page public by moving it out of its vault
`page-create` Create pages
`page-delete` Delete pages
`page-rename` Rename pages
`page-export` Export pages
`asset-read` View attachments
`media-read` Browse and view the media library
`asset-upload` Upload attachments
`asset-delete` Delete attachments
`share-create` Create share links and see your own
`share-extend` Extend your own share links
`share-revoke` Revoke your own share links
`profile-manage` Manage your own profile and preferences
`account-security` Change your password, email and sign-in methods, and approve devices
`config-manage` Change site settings and download backups
`secret-reveal` Show hidden configuration secrets
`comment-create` Add comments and delete your own
`token-mint` Make and revoke your own agent tokens
`token-extend` Extend your own agent tokens
`proxy-grant` Let someone act for you, and stop them
`vault-proxy` Let someone acting for you into your vaults
`store-create` Create your own private store
`asset-edit` Edit attachment details such as photo information
`search-page` Search pages
`search-user` Search for people
`user-read` View the list of people and their profiles
`user-edit` Edit people's accounts
`user-create` Create accounts
`user-delete` Delete accounts
`identity-read` Find and view identity records (users, contacts and organizations)
`identity-manage` Add, change and link identity records (users, contacts and organizations)
`admin-read` View administration screens without changing anything
`admin-system` Administer the site
`admin-roles` Manage roles
`page-raw-edit` Edit a page's raw file, skipping the page editor's checks
`session-revoke` Sign other people out
`audit-export` Export the audit trail

Total Permissions: 39 | Total Roles: 8

Changing User Roles

Access user management (admin permission required)
Select target user
Assign appropriate role from available options
Changes take effect immediately

Integration with ACLs

Roles work seamlessly with Access Control Lists:

Role-based ACLs: Use role names in ACL definitions
Admin Override: Admin users bypass all ACL restrictions
Hierarchical Access: Higher roles typically include lower role permissions
Default Behavior: When no ACL exists, role permissions apply

Example ACL with Roles

Built-in Principals

Beyond user roles, the system recognizes these special principals:

all - Everyone (authenticated and anonymous)
anonymous - Users without authentication
asserted - Users with session but not authenticated
authenticated - Users with valid authentication

Security Model

Design Principles

Least Privilege: Users receive minimum necessary permissions
Role Hierarchy: Clear progression from anonymous to admin
Permission Granularity: Fine-grained control over specific actions
ACL Override: Page-level security can restrict role permissions

Security Features

Role-based access control (RBAC)
Permission inheritance through role hierarchy
ACL integration for page-level security
Admin bypass capability for system maintenance

Best Practices

Role Assignment Guidelines

Start Minimal: Assign the lowest role that meets user needs
Regular Review: Periodically audit role assignments
Principle of Least Privilege: Avoid unnecessary elevated permissions
Document Changes: Track role changes for security auditing

Content Security

Use ACLs for sensitive pages
Combine roles with ACLs for layered security
Regular security reviews of page permissions
Monitor admin activities

Troubleshooting

Common Issues

Access Denied: Check user role and page ACLs
Missing Permissions: Verify role includes required permissions
ACL Conflicts: Ensure ACL principals match user roles

Debugging

Check user's assigned role in user management
Verify role permissions match required actions
Review page ACLs for conflicts
Test with admin account to isolate issues

See Page Level Access Control Lists for page-level security, User Management for managing users, and System Configuration for system settings.