Roles & Permissions

Autoheal uses role-based access control (RBAC) to manage what users can do within the platform. Every user is assigned one role that determines their permissions across investigations, integrations, incidents, and platform settings.

Roles

Autoheal has three built-in roles:

Role	Description
Admin	Full platform access — manage users, integrations, settings, and all operational features
Responder	Full investigation and incident access — create, manage, and resolve. Read-only access to platform configuration
Viewer	Read-only access — view investigations, incidents, integrations, and settings without making changes

Permission Matrix

Users

Permission	Viewer	Responder	Admin
View users	✅	✅	✅
Invite users	—	—	✅
Change user roles	—	—	✅
Remove users	—	—	✅

Investigations

Permission	Viewer	Responder	Admin
View investigations	✅	✅	✅
Create investigations	—	✅	✅
Edit investigations	—	✅	✅
Delete investigations	—	✅	✅
View raw tool output	—	✅	✅
View remediation plans	—	✅	✅

Incidents

Permission	Viewer	Responder	Admin
View incidents	✅	✅	✅
Create incidents	—	✅	✅
Update incidents	—	✅	✅

Integrations

Permission	Viewer	Responder	Admin
View integrations	✅	✅	✅
Add integrations	—	—	✅
Modify integrations	—	—	✅
Delete integrations	—	—	✅
Test integrations	—	✅	✅

Settings & Roles

Permission	Viewer	Responder	Admin
View settings	✅	✅	✅
Modify settings	—	—	✅
View roles	✅	✅	✅
Manage roles	—	—	✅

Managing Users

Inviting Users (Admin)

1

Navigate to Users

Go to Users from the Settings section in the sidebar.

2

Click Invite

Click the Invite member button.

3

Enter Details

Provide:

• Email address(es)
• Role to assign (Viewer, Responder, or Admin)

4

Send Invitation

Click Send Invite. The user will receive an email to join.

Changing User Roles (Admin)

1

Find the User

Go to Users and locate the user.

2

Change Role

Click the change role icon next to their name.

3

Select New Role

Choose the new role (Viewer, Responder, or Admin) and confirm.

note

There must always be at least one Admin. The platform prevents demoting the last Admin to ensure you are never locked out.

Removing Users (Admin)

1

Find the User

Go to Users and locate the user.

2

Remove

Click the delete icon next to their name.

3

Confirm

Confirm the removal. The user will immediately lose access.

How Permissions Work

• All permission checks happen on the server. The UI reflects permissions but cannot be bypassed.
• When a user's role changes, their permissions update within 30 seconds across all active sessions.
• Users can only perform actions explicitly granted by their role (deny by default).

Best Practices

Principle of Least Privilege

Assign the minimum role needed for each user's responsibilities:

• Viewers for stakeholders who need visibility but shouldn't make changes
• Responders for SREs and engineers who actively investigate and respond to incidents
• Admins for team leads who manage platform configuration and user access

Regular Access Reviews

Periodically review user access:

• Remove users who have left the team
• Verify role assignments are still appropriate
• Check for unused accounts

Multi-Tenant Architecture

Autoheal supports multiple organizations (tenants):

• Each organization has its own users, integrations, and data
• Data is isolated between organizations
• Users can belong to multiple organizations
• Roles are assigned per organization, so a user can be an Admin in one org and a Viewer in another

SSO Integration

Autoheal supports SAML 2.0 single sign-on, which any Admin can set up from Settings → Platform → Authentication — see Single Sign-On (SAML).

Roles stay under your control in Autoheal: your identity provider asserts who the user is, and Autoheal decides what they can do. Group and role attributes in the SAML assertion are not read, so there is no IdP-group-to-role mapping to configure.

New users can be created automatically on first SSO login (just-in-time provisioning) and receive your organization's configured default role — Responder unless you change it. Adjust individuals here, from Settings → Users.

FAQ

Can I have multiple Admins?

Yes, you can have multiple Admins. We recommend having at least 2 Admins for redundancy.

What happens when I remove a user?

The user immediately loses access. Their investigation history is retained for audit purposes, but they can no longer access the platform.

Can Responders create integrations?

No, only Admins can create, edit, or delete integrations. Responders can test existing integrations and use them in investigations.

Can Viewers start investigations?

No, Viewers have read-only access. They can view existing investigations and incidents but cannot create new ones or make changes.

What role should I assign to new team members?

Start with Responder for engineers who will actively use the platform for incident response. Use Viewer for stakeholders who only need to monitor. Promote to Admin only when they need to manage users or integrations.