---
title: "User Management & RBAC"
description: "How to invite team members, assign roles, configure permissions, and set up two-factor authentication and passkeys."
version: "en"
---
> Documentation Index
> Fetch the complete documentation index at: https://docs.kliper.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# User Management & RBAC
Kliper uses Role-Based Access Control (RBAC) to govern what each team member can do within your organization. Five built-in roles cover common access patterns; you assign one to each team member.
---
## Roles and Permissions
### Built-In Roles
| Role | Description | Typical User |
|---|---|---|
| **Admin** | Full access to all features, settings, billing, and user management | QSA firm principal, IT administrator |
| **Manager** | Manage assessments, tasks, and team members; approve findings; export reports | Senior QSA, engagement manager |
| **Assessor** | Complete assessments, manage tasks, and upload evidence; no approval or user management | Associate QSA, ISA |
| **QA** | Everything an Assessor can do, **plus review and approve** findings | QA reviewer |
| **Viewer** | Read-only access to all data; no editing or management capabilities | Client stakeholder, external reviewer |
These five are the **system roles** the platform recognizes (`admin`, `manager`, `assessor`, `qa`, `viewer`). QA is the review gate — identical authoring access to an Assessor, plus the ability to approve/reject findings.
### Permission Matrix
The table below shows exactly what each role can do across every resource category:
| Permission | Admin | Manager | Assessor | QA | Viewer |
|---|---|---|---|---|---|
| **Assessments** | | | | | |
| View assessments | Yes | Yes | Yes | Yes | Yes |
| Create assessments | Yes | Yes | — | — | — |
| Edit assessments | Yes | Yes | Yes | Yes | — |
| Approve / reject findings | Yes | Yes | — | Yes | — |
| Export ROC | Yes | Yes | — | — | — |
| Delete assessments | Yes | — | — | — | — |
| **Tasks** | | | | | |
| View tasks | Yes | Yes | Yes | Yes | Yes |
| Create / edit tasks | Yes | Yes | Yes | Yes | — |
| Delete tasks | Yes | Yes | — | — | — |
| **Files / evidence** | | | | | |
| View files | Yes | Yes | Yes | Yes | Yes |
| Upload files | Yes | Yes | Yes | Yes | — |
| Edit file metadata | Yes | Yes | — | — | — |
| Delete files | Yes | — | — | — | — |
| **Users** | | | | | |
| View team / invite members | Yes | Yes | — | — | — |
| Edit roles / remove members | Yes | — | — | — | — |
| **Reports** | | | | | |
| View reports | Yes | Yes | Yes | Yes | Yes |
| Create / export reports | Yes | Yes | — | — | — |
| **Integrations & settings** | | | | | |
| View | Yes | Yes | — | — | — |
| Manage (add/edit/remove, security) | Yes | — | — | — | — |
### Roles are a fixed set
Kliper's roles are a **fixed set of built-in system roles** — Admin, Manager, Assessor, QA, and Viewer — chosen to cover QSA-firm workflows. You don't create or edit roles; you assign one of these five to each team member (see [Adding Team Members](#adding-team-members)).
**Settings > Permissions & Roles** is a **read-only reference**: the **Roles** tab shows each built-in role and how many permissions it carries, and the **Permissions** tab lists the full permission catalog grouped by category. Use it to confirm exactly what a role can do before you assign it.
> **Note**
>
> All five roles are marked **System** and enforced by the platform — they cannot be modified or deleted. If your team needs an access pattern the built-in roles don't cover, let us know; fully custom, enforceable roles are a demand-driven feature.
---
## Adding Team Members
You can **create someone's account directly** (fastest) or **invite them by email** to set their own password.
### Create user (direct)
From the **User Management** page (`/users`), click **Create user** to add a member with no invitation round-trip. It's a **single-page form** (no steps) — identity (name, email), access (role), optional details, and provisioning, with a live record preview that updates as you type. For the password, let Kliper **auto-generate a strong one** or set your own (minimum **12 characters**).
Choose how credentials reach the new user with the **Send welcome email** toggle:
- **On** — the login details are **emailed** to them automatically.
- **Off** — the generated password is shown **once** in-app for you to copy and share securely.
Either way, admin-created accounts must **change the password on first login** — the shared credential is a bootstrap, never the permanent one.
> **Note**
>
> **"Create user"** was previously labelled "Invite people." It provisions the account immediately rather than sending an acceptance link.
### Method 1: Invite by Email
Use this when the person does not yet have a Kliper account, or when you are unsure.
1. **Navigate to Team Settings**
Go to **Settings > Team**. The team management page shows your current members, pending invitations, and admin count.
2. **Click Invite Member**
Click the **Invite Member** button to open the invitation dialog.
3. **Select the Invite by Email Tab**
Enter the invitee's email address and select a role from the dropdown:
| Role | Description |
|---|---|
| Admin | Full access to all features and settings |
| Manager | Manage assessments, tasks, and team; approve findings |
| QA | Review and approve assessment work |
| Assessor | Complete assessments, manage tasks, upload evidence |
| Viewer | Read-only access |
4. **Send Invitation**
Click **Send Invitation**. The system creates a pending invitation with a unique token that expires in **7 days**. The invitee receives an email with a link to accept.
5. **What the invitee sees**
The link opens an accept page showing the organization, inviter, and role. A **new** person sets their name and password and lands in your workspace **already verified** — the emailed link proves address ownership, so there's no separate verification step. Someone with an **existing Kliper account** is added instantly and notified by email; their password is never touched.
### Method 2: Add Existing User
Use this when the person already has a Kliper account but is not in your organization.
1. **Open the Invite Dialog**
Click **Invite Member** and select the **Search Existing** tab.
2. **Search for the User**
Type at least 2 characters of the user's name or email. The search returns matching users who are not already in your organization (up to 10 results).
3. **Select and Add**
Choose a role from the dropdown, then click **Add** next to the user's name. The user is added to your organization immediately — no invitation acceptance required.
### Managing Invitations
The Team Settings page shows all pending invitations. For each pending invitation, you can:
- **Resend** — send the invitation email again (useful if the original expired or was missed)
- **Revoke** — cancel the invitation before it is accepted
### Domain-Based Discovery
When a new user signs up with an email domain that matches your organization's allowed domains, they can discover your organization and request to join. The organization's **Domain Join Policy** controls this:
| Policy | Behavior |
|---|---|
| **Auto Join** | Users with a matching email domain are added automatically |
| **Manual Approval** | Users with a matching email domain can request to join; an admin must approve |
| **Closed** | No domain-based discovery; invitations only |
---
## Managing Team Members
> **Note**
>
> The **Last Active** column is per-organization — it reflects when the member last worked in *this* workspace, not their last login anywhere on Kliper.
### Viewing Your Team
Navigate to **Settings > Team** to see a table of all organization members:
| Column | What It Shows |
|---|---|
| **Member** | Name and email address |
| **Role** | Current assigned role (Admin, Manager, Assessor, QA, or Viewer) |
| **Status** | Active, Pending (invitation sent), or Invited |
| **Last Active** | Timestamp of last platform activity |
Use the **search bar** to filter members by name or email.
### Changing a Member's Role
From the team members table, click the **actions menu** on a member's row and select **Change Role**. Choose the new role from the dropdown and confirm. The role change takes effect immediately.
> **Caution**
>
> You cannot remove the only Admin from an organization, and you cannot demote yourself from Admin if you are the sole administrator.
### Removing a Member
Click the **actions menu** and select **Remove from Team**. A confirmation dialog appears. On confirmation, the user's membership is deactivated and they lose access to all organization data.
### Team Statistics
Three cards at the top of the Team Settings page summarize your team:
| Card | What It Shows |
|---|---|
| **Active Members** | Total members with active status |
| **Pending Invitations** | Invitations awaiting acceptance |
| **Administrators** | Count of users with Admin role |
---
## Enterprise Single Sign-On (SSO)
Kliper supports **enterprise SSO** over **OpenID Connect (OIDC)**, so your team signs in with your existing identity provider — **Okta, Microsoft Entra ID, Auth0, Google Workspace**, or any standards-compliant OIDC provider.
### How it works
- **Identifier-aware login** — when a user enters an email on an SSO-enabled domain, Kliper hides the password field and routes them to your identity provider.
- **Just-in-time provisioning** — first-time users who authenticate through your IdP are created automatically as **members** of your organization.
- **MFA stays with your IdP** — Kliper relies on your provider's multi-factor and conditional-access policies (one-time codes, passkeys, biometrics) and doesn't add a second prompt.
### Setting it up
SSO is enabled by the Kliper team for your organization. Provide your OIDC **issuer / discovery URL**, **client ID and secret**, and the **email domain(s)** to route, and we'll turn on identifier-aware login for those domains.
> **Note**
>
> Kliper's SSO is **OIDC-based**. SAML and SCIM provisioning are not currently offered. Contact the Kliper team to enable SSO for your organization.
---
## Two-Factor Authentication (2FA)
Kliper supports TOTP-based two-factor authentication for an additional layer of account security.
### Setting Up 2FA
1. **Navigate to Security Settings**
Go to **Settings > Security**. The Two-Factor Authentication section shows your current 2FA status.
2. **Click Enable 2FA**
Click **Enable**. A setup wizard opens with three steps.
3. **Scan the QR Code**
A QR code is displayed on screen. Open your authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or any TOTP-compatible app) and scan the code.
If your authenticator cannot scan the QR code, click **Enter manually** to reveal the secret key as a text string.
4. **Verify the Code**
Enter the 6-digit code from your authenticator app into the verification field. Click **Verify**. The system confirms the code matches your secret.
5. **Save Backup Codes**
On successful verification, **8 backup codes** are generated and displayed in a grid. Each code is an 8-character hex string (e.g., `A1B2C3D4`).
- Click **Copy** to copy all codes to your clipboard
- Click **Download** to save them as a `.txt` file
Store these codes securely. Each backup code can only be used once and replaces the authenticator code if your device is lost.
### Signing In with 2FA
After 2FA is enabled, sign-in requires two steps:
1. Enter your email and password (or use OAuth)
2. Enter the 6-digit code from your authenticator app, or use one of your 8-character backup codes
### Trusted Devices
After a successful 2FA verification, you can mark the device as **trusted** to skip 2FA for 30 days. Trusted devices are listed in **Settings > Security > Trusted Devices** with:
- Device name and browser
- IP address
- Last used timestamp
- Expiration date
Click **Remove** on any trusted device to revoke its trust status.
### Disabling 2FA
In **Settings > Security**, click **Disable 2FA**. You must enter a current authenticator code to confirm. All backup codes are invalidated.
---
## Passkeys (Passwordless Authentication)
Kliper supports WebAuthn-based passkeys for passwordless sign-in using biometrics (Face ID, Touch ID, Windows Hello) or hardware security keys.
### Requiring 2FA for Your Organization
Organization admins on the **Team** plan (and above) can make two-factor authentication mandatory for every member of their organization.
1. **Open the policy**
Go to **Settings > Security**. Admins see an **Organization 2FA policy** card.
2. **Enforce**
Click **Enforce**. From that moment, members without 2FA see a blocking enrollment prompt in the app until they set it up — Settings stays reachable so they can enroll.
> **Note**
>
> The policy applies to your organization only. Members are told which organization requires enrollment, and disabling the policy lifts the prompt immediately. On plans below Team, the control shows an upgrade prompt instead.
### Registering a Passkey
1. **Navigate to Security Settings**
Go to **Settings > Security**. Scroll to the **Passkeys** section.
2. **Check Browser Support**
The platform checks if your browser supports WebAuthn. If not, a message indicates that passkeys are not available on your current device.
3. **Click Add Passkey**
Click **Add Passkey**. Optionally enter a name for the passkey (e.g., "MacBook Touch ID"). Your browser's passkey dialog opens.
4. **Authenticate**
Complete the biometric prompt (fingerprint, face scan, or PIN) on your device. The passkey is registered and linked to your account.
### Managing Passkeys
Your registered passkeys are listed with:
| Field | Description |
|---|---|
| **Name** | User-given name or "Passkey" (default) |
| **Device Type** | Platform (built-in biometric) or cross-platform (hardware key) |
| **Backed Up** | Whether the passkey is cloud-recoverable |
| **Created** | Registration date |
Click **Remove** to delete a passkey. You can register multiple passkeys for different devices.
### Signing In with a Passkey
On the sign-in page, click **Sign in with passkey**. Your browser prompts you to select and authenticate with a registered passkey. No password is needed.
---
## Account Security Settings
Additional security options available in **Settings > Security**:
### Password Management
Change your password with real-time strength validation:
| Requirement | Rule |
|---|---|
| Length | Minimum 8 characters (admin-set passwords in **Create user** require 12) |
| Complexity | Upper and lowercase letters, at least one number, at least one special character |
A 5-level strength indicator provides visual feedback as you type.
### Session Management
Kliper enforces a **NIST SP 800-63B AAL2** session profile:
| Control | Value |
|---|---|
| **Session lifetime** | 8 hours, rolling — refreshed about hourly while you stay active |
| **Absolute cap** | 12 hours — you're signed out at 12h even if continuously active |
| **Idle timeout** | Automatic logout after 30 minutes of inactivity |
| **Active sessions** | View every session with device, browser, and last-activity time |
Click **Logout** on any active session to terminate it remotely.
### Appearance and Preferences
| Setting | Options |
|---|---|
| **Theme** | Light, Dark, or System (follows OS preference) |
| **Compact Mode** | Toggle compact UI layout |
| **Animations** | Toggle UI animations |
| **Language** | Interface language selector |
| **Timezone** | Timezone for displayed timestamps |
| **Time Format** | 12-hour or 24-hour |
| **Week Start** | Sunday or Monday |
Source: https://docs.kliper.dev/operations/user-management-rbac/index.mdx