---
title: "Roles and permissions"
description: "See what the viewer, analyst, admin and billing roles can do in Backoffice, which actions need a step-up MFA check, and how admins manage users, disabling and MFA resets."
canonical_url: "https://noxtica.com/docs/security/roles-and-permissions/"
markdown_url: "https://noxtica.com/docs/security/roles-and-permissions/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "security"
section_title: "Security"
site: "Noxtica"
language: "en"
source: markdown
---

# Roles and permissions

Every Backoffice user has a role in each workspace they belong to. The role decides which pages open and which changes the server accepts. This page lists the roles, what each can do, and how an admin manages people.

## What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

### The roles

| Role | Rank | Meant for |
| --- | --- | --- |
| Viewer | 1 | Read-only dashboards, analytics and usage. |
| Analyst | 2 | Everything a viewer can do, plus investigation reads such as the audit log. No write access. |
| Admin | 3 | Workspace management: users, domains, keys, settings, exports, billing. |
| Superadmin | 4 | Noxtica platform staff. Customers cannot assign or invite this role. |
| Billing | none | Finance staff. Holds a short, fixed list of billing capabilities. Available when enabled for your organisation. |

Viewer, analyst and admin form a ladder. A higher role holds everything a lower role holds. Billing is not on the ladder. A billing user never passes a check that asks for admin or analyst. When the billing role is not enabled for your organisation, it cannot be assigned and holds no capability.

The superadmin role works across workspaces and is used for platform operations. A workspace admin cannot grant it, and SSO or SCIM never assign it.

### Step-up MFA

Some actions need a fresh MFA verification. Backoffice shows a prompt and repeats the action after you verify. A verification stays valid for 6 hours. A user who has not enrolled MFA cannot complete a step-up check. See [Sign-in, SSO, SCIM, MFA and IP allowlist](https://noxtica.com/docs/security/sign-in-and-access/).

### Capabilities by role

The table lists customer-visible capabilities. Backoffice labels are used where they exist. A cell says whether the role holds the capability. The last column says whether a change needs step-up.

| Capability | Viewer | Analyst | Admin | Billing | Step-up |
| --- | --- | --- | --- | --- | --- |
| View Dashboard | Yes | Yes | Yes | Yes | No |
| View Analytics | Yes | Yes | Yes | No | No |
| View Fingerprints list, detail and compare | Yes | Yes | Yes | No | No |
| Usage & Quotas | Yes | Yes | Yes | Yes | No |
| View KYC usage | Yes | Yes | Yes | No | No |
| SEO checks and crawl results (read) | Yes | Yes | Yes | No | No |
| Data locations (read) | Yes | Yes | Yes | No | No |
| View Audit Log | No | Yes | Yes | No | No |
| View session replay (metadata) | No | Yes | Yes | No | No |
| View Spot captures (metadata) | No | Yes | Yes | No | No |
| View KYC verifications and review queue | No | Yes | Yes | No | No |
| View agent delegations | No | Yes | Yes | No | No |
| Billing & Plan pages: Wallet, Packages & Add-ons, Invoices, Monthly Reports | No | No | Yes | Yes | No |
| Add funds, subscribe to or cancel a package | No | No | Yes | Yes | Yes |
| Request a plan change or add-on | No | No | Yes | No | No |
| Manage Domains | No | No | Yes | No | Yes |
| Manage Users | No | No | Yes | No | Yes |
| Configure API keys | No | No | Yes | No | Yes |
| Configure mobile attestation apps | No | No | Yes | No | Yes |
| Workspace settings: SSO, SAML, SCIM, IP allowlist, Require MFA, status reports | No | No | Yes | No | Yes |
| Hardware Attestation tabs | No | No | Yes | No | No |
| Export data | No | No | Yes | No | Yes |
| Data Operations | No | No | Yes | No | Yes |
| Manage enforcement rules, agent registry, sealed results | No | No | Yes | No | Yes |
| Play session replay and Spot recordings | No | No | Yes | No | Yes |
| Manage session replay policy and Spot captures | No | No | Yes | No | Yes |
| Review KYC verifications | No | No | Yes | No | Yes |
| Access sensitive KYC evidence | No | No | Yes | No | Yes |
| View calibration, resolve false-positive disputes | No | No | Yes | No | No |

Notes on the table:

- The Billing column shows the four capabilities the billing role holds: Dashboard, Usage & Quotas, the Billing & Plan read pages, and money actions. Nothing else.
- Setting the low-balance warning threshold needs the billing-management capability but no step-up check.
- Buying AI credit packs is a workspace-settings action. It needs the admin role and a step-up check. The billing role cannot do it.
- Backoffice shows a Role capabilities card on the Users page. It is a curated view of the same server rules.
- Hiding a menu item is not the control. If a viewer opens an admin page by link, the server still refuses the save.
- Platform capabilities, for example wallet grants, invoice void and reissue, PSP credentials, grace-period changes, tenant data placement and permanent data deletion, belong to superadmin. They are not part of any customer role.

## Prerequisites

- The admin role to manage users. You can grant roles at or below your own.
- MFA enrolled on your own account, so you can pass step-up checks.
- For the billing role: the role enabled for your organisation. Ask your account team.

## Steps

### 1. Open the Users page

Go to Backoffice → Administration → Users. The list shows Email, Role, Status, Last login and Created. Use the search box for an email, or **Download CSV** to export the list. Click **Show** on the Role capabilities card to see the table above inside Backoffice.

### 2. Add a person

Click **Invite user**. When invitations are enabled for your organisation, you create a single-use link that expires after 7 days. Otherwise you create the user with a temporary password. The full flow is in [Sign-in, SSO, SCIM, MFA and IP allowlist](https://noxtica.com/docs/security/sign-in-and-access/).

The invite form offers Admin, Analyst and Viewer, and Billing when it is enabled for your organisation. You cannot offer a role above your own. Viewer is the pre-selected role.

### 3. Change a role

On the Users page, use the role selector in the person's row, or open the person and use **Role in this workspace**. Giving a higher role asks you to confirm **Grant elevated access?**. The change needs a step-up check and is audited. It ends sessions that are pinned to your workspace, so the person signs in again.

Backoffice refuses to demote, suspend, remove or disable the last active admin of a workspace. The answer is `last_admin_protected`. A Noxtica platform administrator can override this, and that override is audited.

### 4. Disable or enable a person

Use **Disable** (shown as **Revoke** in the list) in the person's row, then confirm. The person cannot sign in until you click **Enable**. Disabling ends all of their sessions. You cannot disable your own account.

If the account belongs to several workspaces, it is a **Shared account**. Account-level actions such as password reset, disabling and session control are available only when your workspace is the account's home and the account has at most one active membership. Otherwise you see only membership actions: **Suspend**, **Reactivate** and **Remove from workspace**. Those affect your workspace only.

### 5. Reset a password

Open the person and click **Reset password**. Enter a new password with at least 12 characters, an uppercase letter, a lowercase letter, a digit and a special character. The action needs a step-up check. You cannot reset your own password here.

### 6. Handle a lost second factor

A workspace admin cannot reset another user's MFA. A Noxtica platform administrator files a reset request with a reason of 5 to 500 characters, and a different platform administrator must approve it. After approval the person is signed out everywhere. At the next sign-in they see **Two-factor authentication was reset** and must enrol again. Contact Noxtica support and name the user.

A person who still has a backup code can sign in with it and then add a new authenticator.

### 7. Remove or delete a person

On the person's page, **Remove from workspace** removes only the membership. The account and its other workspaces are untouched, and the person can be invited back. **Delete user permanently** soft-deletes the account when it has no other memberships. The email is tombstoned so it can be invited again, MFA material is wiped and every session ends. Both actions need a step-up check and are audited. You cannot delete your own account.

## Verify it works

- The person appears on the Users page with the Role and the Status you set.
- Sign in as that person and open a page above their role. The page is hidden, or it opens and the server refuses the change.
- The audit log has rows for the change, such as `user_role_changed`, `user_disable`, `user_enable` or `membership_role_changed`. See [Audit log and data export](https://noxtica.com/docs/security/audit-log-and-exports/).
- The user detail page shows **Role permissions** with the capabilities inherited from the role.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| **Step-up MFA required**, or a verification prompt appears | The last MFA verification is older than 6 hours. | Enter the code from your authenticator app, then repeat the action. |
| A step-up prompt cannot be completed | You have not enrolled an authenticator, so no code exists to enter. | Enable MFA in Settings → Security. |
| `409` with `last_admin_protected` | The change would leave the workspace with no active admin. | Promote another person to admin first, then change this one. |
| **You cannot grant this role** | The role is above your own, Billing is not enabled, or Superadmin was chosen. | Choose a role at or below your own. Ask your account team about Billing. |
| Billing option missing | The billing role is not enabled for your organisation. | Ask your account team. |
| `409` with `account_managed_elsewhere`, or only membership actions shown | The account is shared with other workspaces. | Use **Suspend** or **Remove from workspace**. Password reset and disabling are managed by the account's home workspace or Noxtica support. |
| A message says superadmin users cannot be modified | You tried to change a platform account. | Contact Noxtica support. |
| A person with a Billing role sees no billing e-mails | Billing notices go to workspace admins and the nominated report contact. | Nominate the finance address as the report contact. See [Wallet, invoices and reports](https://noxtica.com/docs/billing/wallet-invoices-reports/). |
| A viewer cannot open Wallet, Packages & Add-ons, Invoices or Monthly Reports | Those pages need the admin role or the billing role. Usage & Quotas stays open to viewers. | Change the role, or use the billing role when enabled. |
| A notice says the Users list is truncated | The workspace has more users than one page shows. | Narrow the list with the search box. |

## Related

- [Sign-in, SSO, SCIM, MFA and IP allowlist](https://noxtica.com/docs/security/sign-in-and-access/): MFA, sessions, invitations and SSO.
- [Audit log and data export](https://noxtica.com/docs/security/audit-log-and-exports/): who can read the audit log and run exports.
- [Plans, packages and add-ons](https://noxtica.com/docs/billing/plans-and-packages/): billing pages and the billing role.
- [Backoffice guide](https://noxtica.com/docs/backoffice/overview/): navigation and the role-filtered sidebar.