Users and Roles

Documentation Index

Fetch the complete documentation index at: https://docs.trueparser.com/llms.txt

Use this file to discover all available pages before exploring further.

TrueParser implements a strict zero-trust, multi-tenant architectural boundary. All user profiles, role definitions, and permission configurations are strictly isolated within your organization’s specific database shard. When your tenant is first activated, it is provisioned with a single default Admin account. This guide covers how to safely scale your development team, configure custom security roles, and enforce least-privilege access using our granular permission matrix.

---

​

1. Inviting Team Members (User Management)

Collaborators are introduced to your tenant boundary via a secure, rate-limited Invitation System rather than public signups. This ensures that only authorized developers, security auditors, or billing managers can access your resources.

​

How it Works:

1. Navigate to the User Management screen.
2. Click Invite User to launch the invite dialog.
3. Specify the recipient’s Email Address and their initial role (e.g., standard Admin or a custom role you’ve created).
4. The control plane validates that no user already exists with that email in your tenant, generates a unique, cryptographically secure invitation token, and queues a welcome email.

---

​

2. Understanding the Invitation Lifecycle

Invitations are stateful and governed by precise business rules to prevent stale tokens or unauthorized access.

---

​

3. Defining Custom Roles

TrueParser is built for enterprise operations and doesn’t lock you into a single broad “Admin” permission set. To support compliance frameworks (like SOC2 or ISO 27001), you can define custom roles that precisely fit your team’s responsibilities.

• Navigate to the Roles tab under User Management.
• Click Create Role and enter a unique, clear name (e.g., Developer, BillingManager, SecOps, Auditor).
• You can set a specific role as the Default Role, causing new team members to automatically receive it upon onboarding.

---

​

4. Fine-Grained Permission Mapping

Every custom role can be configured with highly granular access controls. Clicking the Permissions action on any role loads the TrueParser Permission Matrix, allowing you to toggle feature sets across the UI and API layers.

​

Core Permission Spheres Reference:

Use the accordion below to understand exactly what access each permission sphere controls:

---

​

5. Role-Based Access Control (RBAC) in Practice

Here are three common enterprise role configurations you can set up on your dashboard:

​

The Developer Role

• Purpose: Register backend machine identities and test connections.
• Recommended Permissions:
  • ApplicationManagement.View / Create / Edit
  • Plans.View
  • ApplicationS3Configs.Create / Edit (to link developer buckets)

​

The SecOps Role

• Purpose: Manage system health, liveness parameters, and credentials.
• Recommended Permissions:
  • ApplicationManagement.View
  • SigningKeys.Rotate (to manage key lifecycle)
  • SystemHealth.View

​

The Billing Manager Role

• Purpose: Update payment methods, addresses, and upgrade quotas.
• Recommended Permissions:
  • Billing.Manage
  • Plans.View

---

​

6. Assigning Roles and Enforcing Rules

Once a user accepts their invitation, their profile is marked as active. To update their permissions:

1. Navigate to the Users directory.
2. Click Edit User next to the target profile.
3. Check or uncheck the custom roles from the directory (multiple roles are allowed).
4. Click Save.

The backend immediately rebuilds the user’s security claims. If a user attempts to call an API or perform an action on the dashboard for which they lack permissions, the control plane blocks the request at the gateway level and returns a standard 403 Forbidden response.

---

​

Related Documentation

• Developer Onboarding Sequence
• Authentication & Token Model
• App Setup & Configuration