Users, roles and SSO
Sign in with SAML 2.0 or OIDC single sign-on or local accounts, the four built-in roles, and how team scoping limits what each person sees.
On this page
Roles
| Role | Can |
|---|---|
| Admin | Everything, including users, usage dashboards and repair actions |
| Platform engineer | Read everything; manage budgets, alerts, proposals, notification channels, tag aliases, policies and repairs; write GPU policies and approve or revert GPU optimizer actions |
| FinOps viewer | Read everything, change nothing |
| Team lead | Read and act on their own teams: budgets, alerts, anomalies and proposals |
Team scoping fails closed: a team lead with no team membership sees nothing. Roles are checked on the server for every request, including API calls and the assistant's tools.
Single sign-on
Connect any SAML 2.0 or OpenID Connect provider, such as Okta, Microsoft Entra ID or Google Workspace, in Settings > Sign-in. Map identity provider groups to roles and teams so access follows your directory.
Local accounts
- Passwords hashed with bcrypt.
- Lockout for 15 minutes after 5 failed attempts from the same address and email.
- 15-minute access tokens and 7-day refresh tokens in HttpOnly cookies.
Need help with this guide?Contact support