Role-Based Access Control
SecurityAlert.ai uses a category-based permission model. Each user is granted a level (none / view / manage) for each of 13 product categories. Five built-in role presets cover most cases; admins can also build custom permission blocks per user. Enforcement runs server-side on every API call via Permissions::require(); client-side hidden controls are a courtesy, not a security boundary.
Permission categories
Granted independently per user. The category list is the source of truth for what an admin sees in the user-edit drawer.
Service Alerts
Service status monitoring, alert preferences, alert rules
service_alertsMonitors
HTTP, ping, TCP, SSL, domain, DNS, and heartbeat monitors
monitorsCertificate Inventory
Certificate list, ownership assignments, OCSP/CRL configuration
cert_inventoryCertificate Posture & Compliance
Cryptographic posture score, policies, compliance reports (PCI/SOC2/NIST)
cert_postureRegional Certificate View
Certificates assigned to explicitly granted workspace regions
cert_regionsCertificate Portfolio Administration
Consolidated reports across workspaces the user currently administers
cert_portfoliosBrand Protection
Typosquats, dark web, phishing, finding triage
brand_protectionTakedowns
Submit, update status, add notes, delete cases
takedownsStatus Pages
Public status pages, branding, subscriber lists
status_pagesIntegrations
Slack, Teams, PagerDuty, Opsgenie, webhooks, API keys, STIX/TAXII
integrationsTeam Management
Invite/remove members, assign roles, manage teams
team_managementAudit Logs
View and export audit trail (Enterprise tier)
audit_logsWorkspace Billing (reserved)
Reserved for future account-owned billing. It does not transfer access to another member’s personal Stripe subscription.
billingBuilt-in role presets
Apply a preset to set a sensible permissions block, then tweak individual categories if needed. Editing any category flips the user's role label to "Custom" but keeps the underlying permission block intact.
| Category | Owner | Editor | Certificate Manager | Brand Manager | Auditor (read-only) | Certificate Portfolio Administrator | Regional Certificate Viewer |
|---|---|---|---|---|---|---|---|
| Service Alerts | manage | manage | view | view | view | none | none |
| Monitors | manage | manage | view | view | view | none | none |
| Certificate Inventory | manage | manage | manage | view | view | view | none |
| Certificate Posture & Compliance | manage | manage | manage | view | view | none | none |
| Regional Certificate View | manage | none | none | none | none | none | view |
| Certificate Portfolio Administration | manage | none | none | none | none | manage | none |
| Brand Protection | manage | manage | view | manage | view | none | none |
| Takedowns | manage | manage | view | manage | view | none | none |
| Status Pages | manage | manage | view | view | view | none | none |
| Integrations | manage | view | view | view | view | none | none |
| Team Management | manage | none | none | none | none | none | none |
| Audit Logs | view | none | view | view | view | none | none |
| Workspace Billing (reserved) | manage | none | none | none | none | none | none |
How it shows up
- Server-side enforcement, checked in the API, not the UI. Mutating endpoints call
Permissions::require($userId, 'category.level'); lacking the permission returns HTTP 403 with a JSON error. Workspace-scoped writes (brand and finding triage, VIP watchlists, discovery promotion, team management) are covered. Alert preferences require Service alerts access, and external destinations additionally require Integrations access. Personal presentation settings such as dashboard layout remain scoped to the caller. - Client-side filtering as a courtesy. Sidebar items and action buttons disappear for users without the matching permission, but the server is the trust boundary.
- API keys inherit user permissions. A key minted by an Editor cannot escalate to Owner-only endpoints, even with the
adminscope. - Personal billing is not delegated by a workspace role. Today, Stripe customers and subscriptions belong to the person who started checkout. The reserved Workspace Billing category does not expose another member's payment method, invoices, or portal.
- Audit log of permission changes. Every preset switch and per-category toggle on the user-edit drawer writes an event to the audit log (Business and Custom).
- Organization SSO: discuss your identity provider and provisioning requirements with us before choosing a Custom agreement.
Need this for an RFP or SIG questionnaire?
This page is the canonical reference. Quote it when answering access-control rows on SOC 2, ISO 27001, SIG/CAIQ, or your customer's vendor-risk questionnaire. The model has been live since launch and is enforced server-side on workspace-scoped writes.
Get a vendor-risk packet