Permissions are a matrix, not a role dropdown: tick exactly what a group may reach, area by area. Anything they do not hold simply is not in their sidebar.
Talk to us about access →Name, email as the login identity, group, job title, phone and avatar. Access is decided by the group, not per person.
Every group side by side: the permission catalogue down one side, one column per group, a tick where a group holds it. You can read the whole access model on one screen.
Checkbox pills grouped by area — Content, Assets, User Tools, Developer Tools, System. Tick exactly what that group may reach.
The same form decides which dashboard widgets that group sees, so a group’s home screen is about their job.
Sign in with the fingerprint or face the device already has. Whether people are asked for one is the installation’s choice.
SAML, OIDC and SCIM where a directory already runs the accounts, so joiners and leavers are handled where they are already handled.
A demonstration installation, with invented data.
The matrix lists the tools this installation has, not everything the platform can do. A tool that is not part of the plan is not a greyed-out row inviting a conversation about upgrades — it is simply not there.
Sign-in attempts are rate-limited automatically, with an increasing delay per account and per IP address after repeated failures. There is nothing to switch on and nothing to tune, because a defence that has to be remembered is a defence that is missing on the day it matters.
Access you can read on one screen.
The test of a permission model is whether you can answer “who can publish?” in ten seconds. Here you can, because it is a grid. Get in touch →
