User Management & Role-Based Access Control

Summary

This guide explains how platform administrators manage users and access control on skillSYMS. You’ll learn how to invite and manage users, control sessions and account security, and configure roles and capabilities using the role-based access control (RBAC) matrix.

Who This Guide Is For

• Platform administrators managing user accounts across tenants
• Security administrators defining roles and permissions
• Support staff resolving login and access issues

Prerequisites

Before you begin, ensure you have:

• Platform administrator credentials with user and security permissions
• The email addresses and intended roles of users to invite
• A clear understanding of which capabilities each role should hold

Step 1: Review the User Directory

Navigate to Admin → Users.

This screen lists all platform users with search and filtering. For each user you can open a detail view to inspect their roles, sessions, and account status.

Tip: Use the search and role filters to quickly locate a user reported in a support ticket.

Step 2: Invite a New User

Navigate to Admin → Users → Invite.

Complete the invitation form:

1. Email address of the new user
2. Tenant the user belongs to (or Platform for staff)
3. Role(s) to grant on acceptance

The user receives an email invitation to set their password and activate their account.

Tip: You can send login reminders in bulk from the Users screen for invited users who haven’t yet activated.

Step 3: Manage an Existing User

From Admin → Users, open a user to reach their detail page. From here you can:

• Edit profile details
• Suspend / Unsuspend the account
• Unlock an account locked by failed logins
• Reset password and trigger a new credential
• Delete the user

Step 4: Assign Roles to a User

On the user detail page, open the Roles section.

1. Review the user’s current roles
2. Add or remove roles as needed
3. Save to apply

Roles determine which capabilities the user has across the platform. Changes apply on the user’s next request.

Step 5: Manage Active Sessions

On the user detail page, open the Sessions section to see active sign-ins.

• Revoke an individual session to sign the user out of one device
• Revoke all sessions to force a full re-authentication

Use this when a user reports a lost device or suspected account compromise.

Step 6: Configure Roles & the Permissions Matrix

Navigate to Admin → Security → Roles.

This is the RBAC control centre. From the roles list you can:

• Create a new role
• Open a role to edit its capability grants
• Grant or revoke individual capabilities
• Remove capability overrides

Open a role detail page to see the full capability matrix and toggle each permission the role should hold.

Tip: Start from the principle of least privilege — grant only the capabilities a role genuinely needs, then add more if users hit access limits.

Common Mistakes to Avoid

1. Over-granting roles: Assigning broad roles “to be safe” weakens your audit posture
2. Editing the wrong tenant’s user: Confirm the tenant column before changing roles
3. Deleting instead of suspending: Suspend preserves the audit trail; deletion does not
4. Forgetting to revoke sessions: Resetting a password does not automatically end existing sessions — revoke them for compromised accounts

Verification Checklist

Before finishing, verify:

• Invited users received and accepted their invitations
• Each user holds the correct role(s)
• The permissions matrix reflects least-privilege intent
• No orphaned active sessions remain for offboarded users
• Locked or compromised accounts have been resolved

Next Steps

• Tenant Management — Provision the tenants users belong to
• API Keys & Security — Manage programmatic access and security incidents
• Support Console — Impersonate users safely to resolve issues