Configuring Role Based Access Control (RBAC)

‍

Gremlin provides role-based access control (RBAC) functionality that grants specific privileges to a role. These roles can then be assigned to users to apply the privileges to them. Any action taken in the Gremlin UI or API requires a specific privilege granted by a role. These privileges cannot be assigned independently of roles, although individual users can be assigned to more than one role at a time.

To view or edit users and roles, go to your company settings.

‍

Roles

Roles are split into two categories: company roles, and team roles.

• Team roles grant privileges for actions performed within a Gremlin team, such as starting an experiment, adding a client, or revoking a team API key.
• Company roles grant privileges for actions performed outside the team, such as changing single sign-on (SSO) settings, creating new teams, or removing users from the company.

Though it is possible to create a role from scratch, we suggest that you instead pick an appropriate out-of-the-box role and clone that into new Team and Company Roles in order to add or remove privileges as desired.

‍

Default roles

Gremlin provides the ability to set a Default Role for Companies and Teams. These provide privileges to a user automatically, based on their presence on the company or team.

Default Roles are pointers to out-of-the-box or custom roles which all users of that scope will receive automatically. A Default Team Role can be set at the company level, impacting all teams, and can be overridden on a per-team basis using the Initial Team Role.

The Initial Team Role will be granted to all users of a team, regardless of when they joined, but will override the Default Team Role set at the company level.

‍

Company roles

The following table describes the privileges that are available for company roles, including the default roles.

‍

Team roles

The following table describes the privileges that are available for team roles, including the default roles.

‍

‍

FAQs

Is a user required to have both team and company roles?

No. All roles are granted independently of each other.

Do I have to have a team role to run experiments?

Yes. To run experiments for a team, you need user privileges or higher for that team.