Administration
Roles and permissions
Four roles, in order.
| Role | What it can do |
|---|---|
owner |
Billing, settings, all data. |
admin |
Configure connections, manage users. |
member |
Use Garboard. |
viewer |
Read-only. |
Which actions need which role
| Action | Minimum role |
|---|---|
| See reviews, findings, conventions | viewer |
| Dismiss a finding | member |
| Mute a rule for the organisation | admin |
| Adopt, shadow or un-adopt a catalog rule | admin |
| Edit or delete a derived convention | admin |
| Break-glass | admin |
| Provenance tier settings | admin |
| Configure per-organisation SSO | admin |
| Billing | owner |
Why break-glass is admin-only
It is the one control that lets a merge proceed past a blocking finding. Every member being able to use it would make it the path of least resistance, and a break-glass everyone can pull is not a break-glass — it is a bypass with a dramatic name.
Owners keep the password door
When enforced SSO is on, members must sign in through the identity provider — but owners keep password sign-in, and every break-glass sign-in through it is recorded as the session is minted.
That is deliberate. The obvious design refuses password logins for the whole organisation, and it has one failure mode that matters more than the feature: the identity provider breaks, or was misconfigured, and nobody can get in. Support tickets, a database edit, an outage. So the requirement is not absolute, and the escape hatch is audited instead.