Portal
User Roles
Understanding Portal user roles and permissions
Portal User Roles
Portal uses role-based access control to manage what users can do within the SBOM management platform.
Role Overview
Portal has four primary roles:
| Role | Description |
|---|---|
| Admin | Full Portal administration |
| Manager | Manage products, SBOMs, and sharing |
| Contributor | Create and edit content |
| Viewer | Read-only access |
Role Permissions
Admin
Full access to all Portal features:
| Permission | Access |
|---|---|
| Manage Settings | ✅ |
| Manage Users | ✅ |
| Manage Products | ✅ |
| Manage SBOMs | ✅ |
| Share Externally | ✅ |
| View Analytics | ✅ |
| API Access | ✅ |
| Audit Logs | ✅ |
Manager
Manage content and sharing:
| Permission | Access |
|---|---|
| Manage Settings | Limited |
| Manage Users | ❌ |
| Manage Products | ✅ |
| Manage SBOMs | ✅ |
| Share Externally | ✅ |
| View Analytics | ✅ |
| API Access | ✅ |
| Audit Logs | View Only |
Contributor
Create and edit content:
| Permission | Access |
|---|---|
| Manage Settings | ❌ |
| Manage Users | ❌ |
| Manage Products | Create/Edit Own |
| Manage SBOMs | Create/Edit Own |
| Share Externally | With Approval |
| View Analytics | Limited |
| API Access | Limited |
| Audit Logs | ❌ |
Viewer
Read-only access:
| Permission | Access |
|---|---|
| Manage Settings | ❌ |
| Manage Users | ❌ |
| Manage Products | View Only |
| Manage SBOMs | View Only |
| Share Externally | ❌ |
| View Analytics | ❌ |
| API Access | Read Only |
| Audit Logs | ❌ |
Detailed Permission Matrix
Product Permissions
| Action | Admin | Manager | Contributor | Viewer |
|---|---|---|---|---|
| Create Product | ✅ | ✅ | ✅ | ❌ |
| Edit Any Product | ✅ | ✅ | ❌ | ❌ |
| Edit Own Product | ✅ | ✅ | ✅ | ❌ |
| Delete Product | ✅ | ✅ | Own Only | ❌ |
| View Products | ✅ | ✅ | ✅ | ✅ |
| Manage Versions | ✅ | ✅ | Own Only | ❌ |
SBOM Permissions
| Action | Admin | Manager | Contributor | Viewer |
|---|---|---|---|---|
| Upload SBOM | ✅ | ✅ | ✅ | ❌ |
| Edit SBOM | ✅ | ✅ | Own Only | ❌ |
| Delete SBOM | ✅ | ✅ | Own Only | ❌ |
| View SBOM | ✅ | ✅ | ✅ | ✅ |
| Export SBOM | ✅ | ✅ | ✅ | ✅ |
| Enrich SBOM | ✅ | ✅ | ✅ | ❌ |
Sharing Permissions
| Action | Admin | Manager | Contributor | Viewer |
|---|---|---|---|---|
| Share Externally | ✅ | ✅ | Approval | ❌ |
| Share Internally | ✅ | ✅ | ✅ | ❌ |
| Revoke Share | ✅ | ✅ | Own Only | ❌ |
| View Shares | ✅ | ✅ | Own Only | ❌ |
| Approve Requests | ✅ | ✅ | ❌ | ❌ |
Administration
| Action | Admin | Manager | Contributor | Viewer |
|---|---|---|---|---|
| Manage Users | ✅ | ❌ | ❌ | ❌ |
| Manage Settings | ✅ | Limited | ❌ | ❌ |
| View Audit Logs | ✅ | ✅ | ❌ | ❌ |
| Manage API Keys | ✅ | Own Only | Own Only | ❌ |
| Configure Integrations | ✅ | ✅ | ❌ | ❌ |
Assigning Roles
Invite with Role
When inviting users:
- Go to Settings → Users
- Click + Invite User
- Enter email address
- Select role
- Click Send Invite
Change Role
Modify existing user's role:
- Go to Settings → Users
- Find the user
- Click on their role
- Select new role
- Confirm change
Custom Roles
Creating Custom Roles
For granular control, create custom roles:
- Go to Settings → Roles
- Click + New Role
- Name the role
- Select permissions
- Save role
Custom Role Permissions
Select from available permissions:
Products
products.createproducts.editproducts.deleteproducts.view
SBOMs
sboms.uploadsboms.editsboms.deletesboms.viewsboms.export
Sharing
sharing.externalsharing.internalsharing.approvesharing.revoke
Administration
admin.usersadmin.settingsadmin.auditadmin.integrations
External User Roles
Customer Roles
External customers have different roles:
| Role | Description |
|---|---|
| Customer Admin | Manage their organization's access |
| Customer User | Access shared content |
Customer Permissions
| Action | Customer Admin | Customer User |
|---|---|---|
| View Shared SBOMs | ✅ | ✅ |
| Download SBOMs | ✅ | Per Share |
| Request SBOMs | ✅ | ✅ |
| Manage Their Users | ✅ | ❌ |
Role Best Practices
Assignment Guidelines
| Scenario | Recommended Role |
|---|---|
| Security team lead | Admin |
| Product owners | Manager |
| Developers | Contributor |
| Auditors | Viewer |
| Compliance team | Manager or Viewer |
Principle of Least Privilege
- Start with lowest needed role
- Elevate only when necessary
- Review roles periodically
- Revoke when no longer needed
Role Reviews
Regular role audits:
- Go to Settings → Users
- Review user list
- Check last activity dates
- Verify roles are appropriate
- Remove inactive users
API Access by Role
API Scopes
| Role | API Scopes |
|---|---|
| Admin | All scopes |
| Manager | read, write, share |
| Contributor | read, write (own) |
| Viewer | read |
Generating API Keys
- Go to Profile → API Keys
- Click + New Key
- Key inherits your role permissions
- Additional scope restrictions optional
Troubleshooting
"Access Denied" Errors
- Verify user has correct role
- Check permission matrix
- Confirm resource ownership
- Review custom role settings
Role Not Applying
- User may need to log out/in
- Clear browser cache
- Check for conflicting permissions
- Verify role assignment saved