Least privilege
Menus show only what you may open. Give people the smallest role that does the job.
Roles and permissions
| Role | Can | Limited by scope |
|---|---|---|
| Administrator | Everything: users, roles, settings, keys, storage, servers, plans, restore approval, audit. | No - global |
| Backup Operator | Run manual backups; manage plans, schedules and sources; cancel and retry runs. Cannot read data back. | Yes |
| Restore Operator | Request and carry out approved restores, run verifications and drills, see restore history. | Yes |
| Auditor | Read and export backup and restore history, audit log and reports. No data access. | No - read-only everywhere |
| Viewer | Read-only dashboard and the status of what is in scope. | Yes |
Scopes
Section titled “Scopes”A scoped role acts only on what its user’s scopes name - environments, servers or plans. A Backup Operator scoped to Staging sees and runs Staging plans only; the menu, lists and dashboard all follow the scope.
Rules worth knowing
Section titled “Rules worth knowing”Custom roles
Copy the idea of a built-in role and tick exactly the permissions you need, e.g. a Restore Approver.
Four eyes
Nobody can approve their own restore request.
Secrets stay secret
No role can read a stored password or private key back - they can only be replaced.