Manage app users and roles

App Users and App Roles control access within your applications. Manage them from the Web Apps area and keep them distinct from the account-user roles that govern the Hub.

Manage an app user#

Open Web Apps → App Users to find, create, and maintain users. Check the user's active state, profile, role, and account links before changing access.

Use a dedicated fixture account for development. Updating an app user through a sandbox workflow can still change the same identity used by production apps.

Review role permissions#

Open App Roles to inspect built-in and custom roles. Built-in names include User, Contributor, and Admin, but permissions can be edited. Evaluate the current grants rather than relying on a name alone.

For back-office features, access requires backoffice.access plus the operation-specific permission. The UI can hide navigation or disable actions, while the native IdP APIs enforce permissions on the server.

Typical defaults give Admin broad back-office access, Contributor read access with selected content capabilities, and User/custom roles no back-office access. Always review the stored role when changing a real account.

Authorize custom workflows#

Use an IdP Authorize entry node with the required role or permission, and enforce record ownership in the business logic. A client-side route guard is helpful navigation but does not secure a direct HTTP request.

For user-scoped records, use the authorized identity result rather than accepting a userId supplied by the browser.

Update users through a workflow#

The IdP Users node supports controlled lookup and update operations. It is a privileged operation that needs a trusted preceding authentication/authorization step. It does not expose arbitrary role, activation, or tenant changes through its profile patch.

After changing a role, test both allowed and denied actions from the affected app. Also inspect any cached UI state: server authorization and the screen's current navigation may update on different schedules.