7.1 Roles and permissions

Role	Summary
Administrator	Full control: edit policy, publish, manage agents, users and settings.
Auditor	Read-only: opens every page and drawer, sees every value, cannot change anything.

The console shows the role in the user menu (Administrator or Auditor · read-only) and next to the user name in the sidebar. For an auditor, forms are disabled, Save buttons are hidden and Publish & Sign is not shown. The server enforces the same rules: every write request from an auditor is refused with Read-only role: this action requires an administrator.

Permission matrix

Action	Administrator	Auditor
Open every page, sub-tab and detail drawer; read all labels, rules, groups, AI types, agents, alerts and settings	Yes	Yes
Create, edit, reorder or delete labels, rules, groups, AI document types; Publish & Sign	Yes	No
Agent commands, approval, deletion, diagnostics collection and download	Yes	No (can view agents and their pending-file lists)
Setup: enrolment token, installers, keyed Microsoft 365 manifests, add-in key	Yes	No
AI Classification → Test a document	Yes	No
Audit Log: search, filter, export CSV/JSON, save personal views	Yes	Yes
Reports: generate and download	Yes	Yes
Reports: e-mail a report, manage report schedules	Yes	No
Alerts: change triggers and custom rules	Yes	No
Status: view; restart or start services	View + act	View only
System: health panel, application and service logs; support bundle	Yes	No
Backup: any export, import, restore or schedule	Yes	No
Users: create, edit, rename, delete local users; assign AD roles	Yes	No (can view the list)
Settings: change any sub-tab	Yes	No (read-only; syslog delivery counters hidden)
Live AD search in the Groups and Users pickers	Yes	No
Own account: change own password (local accounts), e-mail address	Yes	Yes
Own account: turn own alert e-mails off	Yes	Yes
Turn alert e-mails on (for self or others)	Yes	No
Personal Overview layout	Yes	Yes