Organisation administration · Public

Tenant roles

How custom roles work in IAM, how they combine with member permissions, and how delegation limits what administrators can assign.

Tenant roles are reusable permission templates inside a tenant. Each role has a stable identifier, a display name, and a list of permissions. When you assign a role to a member, those permissions are applied as locked grants. Members can still receive extra permissions on top of the role, but they cannot remove permissions that come from the role itself.

Authorization still runs on the member's effective permission list. Roles organise access; they do not replace permissions.

Area	Permission	What you can do
IAM → Roles	`iam:roles:edit`	Create roles, rename them, add or remove permissions on the role template, and delete unused custom roles.
Member permissions page	`iam:permissions:manage`	Assign or change a member's role.
Member permissions page	`iam:permissions:manage` / `iam:permissions:delete`	Add extra permissions or remove unlocked permissions on a member.
IAM → Invites	`iam:invites:manage`	Choose a role for the invite and optionally add extra permissions that apply when the invite is accepted.

Default owner role

Every tenant receives a built-in Owner role when it is created. That role:

Carries the * permission, which grants every tenant permission.
Is marked as the default owner role and cannot be deleted.
Cannot be removed from the primary owner membership.
Cannot be selected on invites.

New owners provisioned during tenant setup are assigned this role automatically. Narrow access by creating custom roles and assigning those instead of handing every administrator the Owner role.

Custom roles

Open IAM → Roles.
Create a role and give it a name your administrators will recognise.
Open the role and add the permissions it should grant.
Optionally require passkeys for members assigned to the role when you hold iam:2fa. When organisation-wide passkey enforcement is enabled on the Passkeys tab, role toggles appear checked and locked until that setting is disabled.
Assign the role from a member's permissions page, or choose it when creating an invite.

When you change a role's permission template, ONE updates the locked grants on every member who currently holds that role.

You can delete a custom role only when no members are assigned to it. The default Owner role cannot be deleted.

Locked and additional permissions

On the member permissions page, role permissions are labelled From role. Additional permissions can be added below them.

Type	How it is created	Can it be removed from a member?
Role permission	Assigned automatically from the member's role	No. It is locked on the membership.
Additional permission	Added manually on the member or listed as extra permissions on an invite	Yes, with `iam:permissions:delete`, subject to delegation rules.

Delegation rules for roles

The same delegation limits that apply to direct permission edits also apply to roles, invites, and CSV imports. An administrator can only hand out access they already hold.

These checks prevent privilege escalation through role templates, invites, imports, member edits, or bulk selection.

Examples

A member with iam:members:view can assign a read-only role that contains only iam:members:view. They cannot assign a role that includes iam:members:manage.
A member with iam:* can assign any role and add any permission they define in IAM.
A member with iam:permissions:delete cannot remove cas:manage from another member unless they hold cas:manage or a wildcard that covers it.

Action	Delegation check
Add a permission to a role	You must already hold that permission, or a broader wildcard that covers it.
Remove a permission from a role	You must already hold that permission, or a broader wildcard that covers it.
Assign a role to a member	Every permission on the role template must be within your own grants.
Add an extra permission to a member	Same rule as adding a permission directly.
Remove an unlocked permission from a member	You must already hold that permission, or a broader wildcard that covers it.
Manage a member at all	Every permission on the member's membership — locked role grants and additional grants — must be within your own grants.
Create an invite	The invited role's permissions plus any extra invite permissions must be within your own grants.
Import members from CSV	Each row's role and permission changes must stay within your own grants, including the member's resulting permission set.
Bulk remove members	Same checks as removing one member. Cannot include yourself or the primary owner.
Bulk assign a role	Same checks as assigning a role to one member. Cannot demote the primary owner off the Owner role.
Bulk add a permission	Same checks as adding a permission to one member. Members who already hold the permission are skipped.

CSV import and role references

Enterprise imports accept a role column. You can provide either:

A role UUID from your tenant, or
An existing role name from your tenant.

Skyfallen ONE resolves the value in this order:

Match the value against a role UUID in the current tenant.
If there is no UUID match, treat owner as the built-in Owner role.
Otherwise match a role name case-insensitively.

Other legacy values such as admin and member match a role only when your tenant already has a role with that name. UUIDs are the safest choice when names are duplicated or renamed.

On Members → Import, expand Role references for CSV import under the upload section to copy role UUIDs into your CSV. The same list is available from IAM → Roles when you need to review role templates.

Use the permissions column for additional unlocked grants on top of the role.

API exposure

SAPP and CAS expose role identifiers rather than legacy enum labels.

Permission names on the membership still drive IAM and connected-application checks. See Tenant permissions reference for the full permission catalog.

API	Role fields
SAPP membership reads	`role_id` and `role: { id, name }`
CAS membership reads	`role` contains the role UUID; `role_name` carries the display name

Support

Request Help

Open a Skyfallen ONE support request for your organisation and continue the conversation in Success Manager.

Open a request