Groups and RBAC#

IncidentRelay uses two permission layers:

• Group roles define the access boundary and group-level administration.
• Team roles define what a user can do inside a specific team.

A user must belong to a group before they can belong to a team in that group. Adding a user to a team does not add the user to the group automatically.

Global admin#

A global admin can manage the whole installation:

• create, update and delete groups;
• create and manage users;
• add existing users to groups;
• assign any group role, including user_admin;
• manage all teams and resources;
• view all data.

A global admin should not be able to delete or disable themselves, and the system should keep at least one active global admin.

Group roles#

Group Admin boundaries#

user_admin is intentionally limited:

• can create a new user only inside the selected group;
• the created user is automatically linked to that group;
• cannot pass or override group_id in request body;
• cannot create a global admin user;
• cannot assign another user_admin;
• cannot add an existing user to a group;
• cannot move a user between groups;
• cannot globally disable or delete a user.

Group Editor boundaries#

editor is an operational group-level role.

A Group Editor can:

• create teams inside the group;
• create and edit group-level operational resources;
• manage a team only when they also have the manager role in that team.

A Group Editor cannot:

• manage users;
• assign group roles;
• assign user_admin;
• manage every team in the group automatically;
• edit rotations, routes, services, channels or silences of a team where they are not a Team Manager.

When a Group Editor creates a new team, IncidentRelay adds that user as manager of the created team.

Adding an existing user to a group changes the group boundary and is global-admin only.

Team roles#

A group editor does not automatically become manager of every team in the group. Team write access requires the manager team role.

When a non-admin group editor creates a new team, IncidentRelay should add that creator as manager of the created team.

Permission matrix#