Roles and permissions
Every member of a Tidehawk workspace holds one of three roles. The role decides which pages they can open and which API calls succeed.
The three roles
Section titled “The three roles”- Owner — the person who created the workspace. There is one owner, and the role cannot be changed or removed from the Team page.
- Admin — trusted staff who run the workspace: team, billing, integrations and alert routing.
- Technician — day-to-day monitoring. The default role when you invite someone.
What each role can do
Section titled “What each role can do”| Task | Owner | Admin | Technician |
|---|---|---|---|
| View the dashboard, inventory and reports | Yes | Yes | Yes |
| Add, edit and archive clients and domains | Yes | Yes | Yes |
| Mark a certificate as tracked or renewed | Yes | Yes | Yes |
| Manage their own profile, notifications and second factor | Yes | Yes | Yes |
| Permanently delete a client | Yes | Yes | No |
| Change the workspace name and timezone | Yes | Yes | No |
| Create, edit and delete alert rules | Yes | Yes | No |
| Connect and configure PSA integrations | Yes | Yes | No |
| Invite members, change roles and remove members | Yes | Yes | No |
| View the audit log, export it and generate evidence reports | Yes | Yes | No |
| Start a checkout and open the Stripe billing portal | Yes | Yes | No |
| Turn on workspace-wide two-factor authentication | Yes | No | No |
| Export all workspace data | Yes | No | No |
| Request erasure of the workspace | Yes | No | No |
A technician who opens the audit log sees a message saying access is restricted to owners and admins. An API call made above a member’s role returns a 403 response rather than a partial result.
Rules that apply to everyone
Section titled “Rules that apply to everyone”The owner role is protected. Nobody, including another owner-level session, can change the owner’s role or remove the owner through the Team page. You also cannot change your own role or remove yourself.
Neither role grants access to another workspace. Tenant separation is enforced in the database, not only in the interface. See How Tidehawk protects your data.
Changing someone’s role
Section titled “Changing someone’s role”- Open Team.
- Find the member and use the role dropdown next to their name.
- Choose Technician or Admin.
The change takes effect on that person’s next request. They do not need to sign out and back in. The change is written to the audit log with your name against it.