Roles & Permissions

NEURO uses role-based access control (RBAC) to manage what users can see and do within the platform.

Role Hierarchy

┌─────────────────────────────────────────────────────────────┐
│                         Admin                                │
│  Full platform access + user management + settings           │
├─────────────────────────────────────────────────────────────┤
│                        Analyst                               │
│  Create/edit projects, findings, reports                     │
├─────────────────────────────────────────────────────────────┤
│                        Reviewer                              │
│  View and comment on all content                             │
├─────────────────────────────────────────────────────────────┤
│                        Viewer                                │
│  Read-only access to assigned projects                       │
└─────────────────────────────────────────────────────────────┘

Permission Matrix

Project Permissions

Action	Admin	Analyst	Reviewer	Viewer
View all projects	-	-	-	-
View assigned projects	-	-	-	-
Create projects	-	-	-	-
Edit projects	-	-	-	-
Delete projects	-	-	-	-
Archive projects	-	-	-	-

Finding Permissions

Action	Admin	Analyst	Reviewer	Viewer
View findings	-	-	-	-
Create findings	-	-	-	-
Edit findings	-	-	-	-
Delete findings	-	-	-	-
Import findings	-	-	-	-
Comment on findings	-	-	-	-

Report Permissions

Action	Admin	Analyst	Reviewer	Viewer
View reports	-	-	-	-
Generate reports	-	-	-	-
Download reports	-	-	-	-
Manage templates	-	-	-	-

Client Permissions

Action	Admin	Analyst	Reviewer	Viewer
View clients	-	-	-	-
Create clients	-	-	-	-
Edit clients	-	-	-	-
Delete clients	-	-	-	-
Manage portal users	-	-	-	-

Administration Permissions

Action	Admin	Analyst	Reviewer	Viewer
Manage users	-	-	-	-
Tenant settings	-	-	-	-
View audit logs	-	-	-	-
Manage integrations	-	-	-	-
Manage API keys	-	-	-	-

Role Descriptions

Admin

Best for: Team leads, managers, account owners

Administrators have full access to all platform features plus the ability to:

Manage all users and their roles
Configure tenant-wide settings
Access audit logs
Manage integrations and API access
Configure security policies

Analyst

Best for: Security consultants, penetration testers

Analysts can perform all assessment-related work:

Create and manage projects
Document findings with full editing
Generate and configure reports
Import scan data
Manage client relationships
Collaborate via chat

Reviewer

Best for: QA personnel, senior reviewers, managers without edit needs

Reviewers can oversee work without modifying content:

View all projects and findings
Add comments and feedback
Download reports
Participate in discussions
Cannot modify findings or reports

Viewer

Best for: Stakeholders, executives, external observers

Viewers have limited, read-only access:

View only assigned projects
Read findings without editing
Download available reports
Cannot comment or participate

Project-Level Roles

Beyond platform roles, users have project-specific roles:

Project Lead

Primary owner of the project
Can delete the project
Manages team assignments
Default notification recipient

Project Member

Full edit access to project content
Can add findings and assets
Can generate reports

Project Reviewer

View and comment only
Cannot edit project content
Receives review notifications

Assigning Roles

Platform Role

Assigned during user creation:

Settings → Users
Click Edit on user
Select role from dropdown
Save changes

Project Role

Assigned per project:

Open project
Go to Settings → Team
Add user and select role
Save

Role Best Practices

Principle of Least Privilege

Assign the minimum role needed:

Start with Viewer
Upgrade as responsibilities grow
Regular role reviews

Role Assignment Guidelines

User Type	Recommended Role
New team member	Analyst (after training)
Senior consultant	Analyst
Team manager	Admin
QA reviewer	Reviewer
Executive stakeholder	Viewer
External auditor	Viewer

Multiple Projects

Users can have different project roles:

Analyst on Project A
Reviewer on Project B
Not assigned to Project C

Special Permissions

Godmode (Super Admin)

For NEURO support personnel:

Access across all tenants
Used for support only
Full audit logging

Client Portal Users

Separate permission set:

See Client Portal

Troubleshooting

”Permission Denied” Error

Check user’s platform role
Verify project assignment
Confirm project-level role
Contact admin if needed

Can’t See Projects

Viewer role only sees assigned projects
Check project team membership
Verify account is active

Can’t Edit Content

Reviewer/Viewer roles are read-only
Check platform role
Verify project role allows editing

Next: Learn about Security Settings