Users, roles & permissions

Access is where you control what each person can do. What someone can do is decided by the role they hold, and each role is a bundle of permissions. Menu: Access → Roles · Route: /admin/roles Menu: Workspace → Users · Route: /admin/users (super admins only)

---

​

How the model works

• A permission leaf is one granular ability, identified by a dotted id such as comerix.flows.publish or comerix.insights.reports.view.
• A role collects many permission leaves under one name.
• Each member holds a role per workspace, so the same person can have different roles in different workspaces.

System roles are global and ship with the platform; custom roles are created per workspace.

---

​

Browse roles

1. In the left sidebar, choose Access → Roles.
2. The list opens at /admin/roles.

Each role shows whether it is a system or custom role, its member count, permission coverage (X of Y leaves granted), and a per-module breakdown. The metrics strip shows permissions in the catalog, total roles, custom roles, and members assigned.

---

​

Create a custom role

1. On the Roles list, click New role.
2. Enter a name (must be unique) and an optional description.
3. Save. The role opens in the editor so you can grant permissions.

---

​

Grant permissions to a role

1. Open a role and select the Resources tab.
2. Work through the permission tree — it nests from comerix → comerix.access → … down to individual leaves. Tick the boxes you want to grant.
3. Use Select all / Clear all and Expand all / Collapse all to move quickly.
4. The summary sidebar shows X of Y granted per module as you work.
5. Click Save.

---

​

Reassign a member

1. Open a role and select the Users tab.
2. You see every member who holds this role.
3. To move a member, pick a different role for them, or remove them from this role.

---

​

Platform user administration (super admin)

/admin/users is the platform-wide User Administration console. Unlike the role-based screens above — which stay inside a single workspace — this console lists every user across all organizations and workspaces on the platform. The whole page is gated to super admins (ROLE_SUPER_ADMIN); the Users entry only appears in the Workspace section of the sidebar when you hold that status.

1. In the left sidebar, choose Workspace → Users.
2. The console opens at /admin/users.

The left scope rail lets you narrow the directory to all users, a single organization, or a single workspace. The toolbar adds a search box (name or email), a status filter (active / inactive), a role filter, and segment tabs (all, active, super admins, inactive). The metrics strip shows total users, active users, super admins, and inactive users for the current scope. Each row is shown once per user, anchored on the user’s home workspace, and lists their name, email, status, home role, and the workspaces they belong to.

​

Create or edit a user

1. Click New user to open the create dialog, or the Edit (pencil) action on a row.
2. Set the email (required and unique), an optional name, the interface locale, and the Active toggle.
3. Choose a home workspace and a role for that workspace. You can pick a global system role or a role owned by the chosen workspace.
4. Toggle Super admin to grant or revoke platform-wide super-admin status.
5. Save.

When you create a user without a password, the platform emails them a password-reset link so they can set one themselves. If you type a password in the create dialog, it is used directly and no email is sent.

​

Activate or deactivate

Use the per-row Activate / Deactivate toggle to change a user’s status.

​

Send a password-reset link

Use the per-row Reset password action to email the user a fresh password-reset link. This never reveals or sets a password directly — the user sets their own from the emailed link.

​

Impersonate a user

Impersonation lets you sign in as another user to reproduce or support an issue, scoped to that user’s workspace context.

1. Click the Impersonate (eye) action on a row and confirm.
2. The platform switches your session to the target user using Symfony’s switch_user mechanism.
3. While impersonating, a persistent banner at the top of every page reads “Impersonating … — you are viewing the app as this user.” with an Exit impersonation link that returns you to your own account.

​

Bulk actions

Select rows with the checkboxes, then apply a single action to all of them at once: activate, deactivate, delete, or assign a role in a chosen workspace. Skipped rows (for example, your own account, or the last remaining super admin) are reported back to you.

​

Deleting a user

Deleting a user is a GDPR-style anonymizing erasure, not a physical row delete: it drops all the user’s workspace memberships, revokes every role, deactivates the account, and scrubs the identity. The record itself is retained so the append-only audit log stays intact. The platform refuses to delete your own account or the last super admin.

---

​

Permissions

---

​

Related pages

• Workspace, members & security policy
• Your account & security
• Core concepts
• Back to home