​

Roles & Permissions in Altostrat SDX

​

Key Concepts

• Permissions (Scopes): Fine-grained strings representing specific actions, typically in the format resource:action (e.g., site:view, billing:update, api:create). These scopes directly control access to API endpoints and influence what is visible or actionable in the user interface.
• Roles: Collections of permissions. Assigning a role to a user grants them all the permissions contained within that role for the team they are assigned to.
• System Roles: Predefined roles with common permission sets provided by Altostrat SDX (e.g., Owner, Administrator, potentially a read-only or member role). System roles usually cannot be deleted or fundamentally altered.
• Custom Roles: Roles you create and manage within your team, allowing you to tailor access precisely by selecting specific permissions.
• Team Context: Role assignments are specific to a Team. A user might be an Administrator in one team but only have view permissions in another.

​

Permission Scope Reference

​

Creating a Role

1

Navigate to Roles & Permissions

In the Altostrat SDX Dashboard, go to Settings → Roles & Permissions. You will see a list of existing system and custom roles for your current team.

Roles & Permissions main view listing existing roles.

2

Start Creating a New Role

Click the + Add button. A form will appear to define the new role. Enter a descriptive name (e.g., “NOC Level 1”, “Billing Manager”) that clearly indicates the role’s purpose.

Entering the name for the new custom role.

3

Assign Permissions (Scopes)

Scroll through the list of available permissions, grouped by category. Select the checkboxes corresponding to the scopes (e.g., site:view, billing:update) you want to grant to this role.

Selecting specific permission scopes like 'site:view' and 'billing:view'.

4

Save the Role

Once you have selected all the desired permissions, click the Save button. The new custom role will be created and appear in the list, ready to be assigned to users within the team. (This typically corresponds to a POST /team_roles API call).

The newly created role saved and appearing in the list.

​

Editing a Role

1

Select the Role to Edit

Navigate to Settings → Roles & Permissions. Find the custom role you wish to modify in the list and click on its name or an associated ‘Edit’ icon.

Clicking on the 'NOC Ops' role to edit its permissions.

2

Modify Name or Permissions

In the role editing form, you can change the role’s name and adjust the assigned permissions (scopes) by selecting or deselecting the checkboxes.

Adding the 'site:action' scope and removing 'team:delete' scope from the role.

3

Save Changes

Click the Update or Save button to apply your modifications. All users currently assigned this role within the team will inherit the updated set of permissions. (This corresponds to a PUT /team_roles/ API call). Users might need to refresh their session (e.g., log out and back in) for changes to take full effect.

Saving the updated role permissions.

​

Deleting a Role

1

Locate the Custom Role

Go to Settings → Roles & Permissions. Find the custom role you want to remove from the list. System roles will typically not have a delete option.

Identifying the custom role 'Temporary Access' to be deleted.

Locating the delete icon (trash can or menu) next to the custom role.

2

Confirm Deletion

Click the delete icon (e.g., trash can or via a menu) associated with the role. A confirmation prompt will appear. Carefully review the impact and confirm the deletion. (This corresponds to a DELETE /team_roles/ API call).

The delete option might be hidden off-screen on smaller displays or if the role has many permissions listed horizontally. You may need to scroll horizontally to find it.

Clicking the delete icon and confirming the removal of the role.

​

Assigning Roles to Users

1. Navigate to Team Settings -> Members.
2. Select the user whose roles you want to manage within the current team.
3. Assign one or more available roles (system or custom) to the user.
4. Save the changes.

​

Best Practices

• Use System Roles First: Leverage predefined roles like Administrator or Member for common access patterns before creating custom ones.
• Principle of Least Privilege: Grant only the necessary permissions (scopes) required for a user to perform their job function within a team. Avoid overly broad roles.
• Create Task-Specific Custom Roles: Define roles based on responsibilities (e.g., “Billing Viewer,” “Site Operator,” “Security Auditor”) rather than individual users.
• Regular Audits: Periodically review role definitions and user assignments to ensure they are still appropriate and align with current responsibilities and security policies.
• Document Custom Roles: Clearly document the purpose and intended permissions of each custom role you create for your team’s reference.