Admin Users & RBAC

Managing admin users and role-based access control.

Overview

BlueSentinel uses Role-Based Access Control (RBAC) with four permission levels.

Roles

Role	View	Manage	Admin	Cross-Tenant
`viewer`	Yes	No	No	No
`tenant_manager`	Yes	Yes	No	No
`tenant_admin`	Yes	Yes	Yes	No
`super_admin`	Yes	Yes	Yes	Yes

Permission Matrix

Action	Viewer	Manager	Admin	Super Admin
View devices, alerts, policies	Yes	Yes	Yes	Yes
Send remote commands	No	Yes	Yes	Yes
Manage USB whitelist	No	Yes	Yes	Yes
Generate enrollment tokens	No	Yes	Yes	Yes
Create/edit policies	No	No	Yes	Yes
Create/delete groups	No	No	Yes	Yes
Manage exceptions	No	No	Yes	Yes
Create admin users	No	No	Yes	Yes
View audit log	No	No	Yes	Yes
Access recovery keys	No	No	Yes	Yes
Manage across tenants	No	No	No	Yes

Creating Admin Users

Navigate to Users (requires tenant_admin role)
Click Create User
Enter email, name, password, and role
The user is automatically scoped to the current tenant

Password Security

Passwords are hashed using bcrypt
No password is stored in plaintext
The default admin password (admin123) must be changed immediately after first login

Audit Trail

All admin actions are logged in the Admin Audit Log with:

Who performed the action
What action was taken
Target type and ID
Detailed payload of changes
Timestamp