How Personal Accounts Work
This page explains how Personal Accounts work in Qualytics, from provisioning and authentication to team-based access control.
How Users Are Provisioned
Personal Accounts are created in three ways: an administrator invites the person by email, the person signs in through an identity provider for the first time, or Directory Sync provisions the account ahead of time.
| Method | How It Works |
|---|---|
| Email Invitation | A user with the Admin role invites the person by email. The account is created with the invited role when the person sets a password and activates it. Available when an Email & Password sign-in provider is enabled. |
| Identity Provider (First Sign-In) | The person authenticates through one of your sign-in providers (OIDC or SAML) and Qualytics creates the account at the first sign-in. |
| Directory Sync (SCIM) | Users are pre-provisioned from your identity provider before they log in, allowing team and role pre-assignment. |
Users created at their first identity provider sign-in receive the Member role and join the Public team. Invited users receive the role selected in the invitation. Directory Sync can assign a mapped role; otherwise, provisioned users also receive the Member role. A user with the Admin role can update role and Team assignments after the account is created.
Info
For managed and self-hosted SSO options, see the SSO documentation. For automated provisioning, see Directory Sync.
Self-hosted deployments using OIDC can also add accounts to Teams at sign-in based on the groups presented by your identity provider. See Just-in-Time Provisioning and Group Sync.
User Roles
Every user is assigned a role that controls their platform-level permissions: Admin, Manager, or Member.
Info
For detailed capability tables per role, see the User Roles page.
| Role | Access Level |
|---|---|
| Admin | Full platform access to manage users, teams, datastores, connections, and all settings. Not subject to team permissions. |
| Manager | Limited admin access to create datastores and manage tags, notifications, and connections. Subject to team permissions for datastore content. |
| Member | Standard access inherited from team membership. Can generate personal tokens and view library/tags. |
Team-Based Access
Access controls in Qualytics are assigned at the datastore level through Teams. A user without the Admin role can have one of the following levels of access to any datastore:
- Editor: Full datastore management, including enrichment, scoring, computed fields, operations, and field status.
- Author: Manage checks, including activation, validation, status, and metadata.
- Drafter: Create and save checks as drafts without activating them.
- Viewer: Read-only access to anomalies with the ability to comment on the Timeline of containers, quality checks, and anomalies.
- Reporter: Read-only access to all report information including dashboards, overviews, and anomalies.
Note
Permissions are assigned to Teams rather than directly to users. Users inherit the permissions of the teams to which they are assigned.
All users are part of the default Public team, which provides access to all Public Datastores. Admins can create and manage additional teams, assigning both users and datastores to them.
Info
For detailed permission matrices per team permission, see How Teams Work.