Skip to content

Enterprise RBAC Role Administration

Enterprise edition provides an admin console for managing user roles and account status. All role changes are tenant-scoped and audit-logged for compliance.

Accessing /admin/users

  1. Navigate Admin → Users (requires admin:users scope, granted to org_admin, enterprise_admin, and system_admin)
  2. View cursor-paginated list of all users with current role and active status

Clerk session-token prerequisite

With Clerk authentication, the admin user's role must be visible to the app's page guard. This requires a one-time session-token customization in the Clerk dashboard (add the publicMetadata claim) plus setting each admin's public_metadata.role. See Enterprise Deployment → Configure Clerk Authentication. The database role remains authoritative and the API is enforced server-side, so an admin without the claim is not locked out — but setting it avoids a redirect flash and gives the cleanest gate.

Changing User Roles

  1. On the Admin Users page, click the role dropdown next to a user
  2. Select new role: org_member (standard user), org_admin (org administrator), or enterprise_admin (system admin)
  3. Click Save

Guard rails enforced: - Cannot change your own role - Cannot assign roles above your privilege level - system_admin is NOT assignable (service-account-only role; provisioned via seed tooling)

Deactivating Users

  1. Click Actions → Deactivate next to a user
  2. (Optional) Enter deactivation reason
  3. Confirm

Deactivation sets is_active=False, blocking login while preserving audit history and artifact ownership.

Role Authority & Audit Log

Authority: Database enterprise_users.role is authoritative over Clerk JWT org_role — external identity provider changes do NOT silently override the DB value (D1/RH3). This prevents privilege escalation from misconfiguration.

Audit: Every role mutation writes a tenant-stamped audit event. View Admin → Audit Logs, filter by ENTERPRISE_USER_ROLE_CHANGED or ENTERPRISE_USER_DEACTIVATED to see actor ID, timestamp, and trace ID for correlation.