Core Athentra Platform · Access Control
Role-Based Access Control
Roles run from Customer, Organisation and Tenant Administrator, each with a Billing Administrator variant so purchasing can be delegated without operational control, down to module-specific roles, including one per compliance workload so the person responsible for Teams sees the Teams picture without the Entra one. A broader role implies the narrower ones beneath it, peers can remove each other's roles, and a customer's last Customer Administrator can never be removed. The easy option stops being a blanket grant.
- 01
Pain Point
What's the problem?
Broad administrator rights get handed out because the alternative is a permissions model nobody understands.
- 02
Remedy
How do we attack it?
Grant module-specific roles within a hierarchy that runs from customer down to tenant
- 03
Your Value
What do you get out of it?
People get the access their job needs rather than the access that was easiest to grant