Skip to main content
CauseFlow uses role-based access control (RBAC) to manage what each user can do within a tenant. Every request is authorized against the roles encoded in the user’s JWT token and scoped to a single tenant.

​
Roles

Admin

Full platform access including multi-tenant management. Intended for platform administrators who manage multiple organizations.

Owner

Full access within their own tenant — incidents, team management, billing, and configuration. Typical role for engineering leads and team managers.

Operator

Can triage incidents, run investigations, and approve or reject remediations. Cannot manage team members, billing, or tenant configuration. Typical role for on-call engineers.

Viewer

Read-only access to incidents, investigation results, and audit trail. Cannot create incidents or take any action. Typical role for stakeholders and executives.

​
Permission matrix

ActionAdminOwnerOperatorViewer
View incidents and investigationsYesYesYesYes
View audit trailYesYesYesYes
Create incidents manuallyYesYesYesNo
Triage and investigate incidentsYesYesYesNo
Approve or reject remediationsYesYesYesNo
Manage team members and rolesYesYesNoNo
Manage API keysYesYesNoNo
Configure integrationsYesYesNoNo
Manage investigation policyYesYesNoNo
Manage billing and subscriptionYesYesNoNo
Create and manage tenantsYesNoNoNo
Manage all tenants (platform-wide)YesNoNoNo

​
Assigning roles

Roles are assigned per tenant. A user can have different roles in different tenants (for example, Owner in their primary tenant and Viewer in a partner tenant). To assign or change a role:
  1. Go to Dashboard > Team.
  2. Find the team member and click Edit.
  3. Select the new role from the dropdown.
  4. Click Save.
Only admin and owner roles can manage team members. To invite a new team member:
  1. Go to Dashboard > Team.
  2. Click Invite member.
  3. Enter their email and select a role.
  4. Click Send invite.
The invited user receives an email with a sign-up link. They are added to your tenant with the assigned role upon completing sign-up.

​
Tenant isolation

Every request in CauseFlow is scoped to the tenant_id claim in the user’s JWT token. This is enforced at the data access layer — not just the application layer. DynamoDB partition keys include tenant_id as a component. A query for tenant A’s incidents cannot physically return tenant B’s data, even in the event of a logic error. There is no shared-data model where misconfiguration could expose cross-tenant records. Consequences:
  • Users cannot access data outside their tenant, regardless of their role
  • Support engineers cannot view customer data without an explicit tenant-scoped token
  • Platform admins (admin role) create and manage tenants but access tenant data only through tenant-scoped sessions

​
RBAC enforcement in the API

RBAC checks happen server-side on every API request. The client cannot escalate privileges by modifying the request. If a request requires a permission the caller’s roles do not have, the API returns 403 Forbidden. Role checks are not cached — they are evaluated on every request against the current state of the user’s roles. If a user’s role is changed, the new permissions take effect on their next API request.
Changing a user’s role does not invalidate their existing JWT token immediately. The token continues to carry the previous roles until it expires or is refreshed. For immediate role changes (for example, offboarding), revoke the user’s session from Dashboard > Team > Revoke access.