4.3 Roles
| Role | Can do |
|---|---|
| Administrator | Everything: edit and publish policy, manage agents, users and settings. |
| Auditor | Read-only: dashboards, audit log, reports and every settings page; can open every drawer but cannot change anything. |
The full permission matrix is in 7.1. The last administrator cannot be deleted or demoted, and nobody can delete their own account or change their own role.