Roles and permissions

SentryAssets has five fixed roles. For OIDC accounts the role comes from the identity provider’s groups at every sign-in (Setup). Under Settings › Roles and permissions, administration, information security and auditors see the same table every request is checked against.

Role	Key	Meant for
Administrator	admin	operations and setup: everything, including sign-in, users, agents, notifications, system health
Information security	isb	information security officers: inventory and IT-Grundschutz in full, audit log, licence keys
Editor	editor	the IT team day to day: inventory, locations, licences, contracts, documents, Grundschutz check
Auditor (read only)	auditor	internal or external audit: read everything including the audit log, change nothing
Read only	viewer	information: read inventory and records

If more than one group matches at sign-in, the role with the most rights applies. Without a matching group the sign-in is refused.

Permissions in detail

Area	Administrator	Information security	Editor	Auditor	Read only
Read inventory, locations, licences, contracts, racks, consumables	yes	yes	yes	yes	yes
Change inventory, locations, licences, contracts, racks, consumables	yes	yes	yes	–	–
Manage categories and fields	yes	yes	–	–	–
Read personal field values and contacts	yes	yes	yes	–	–
Read IT-Grundschutz	yes	yes	yes	yes	–
Edit the Grundschutz check	yes	yes	yes	–	–
Manage information domains and catalogues	yes	yes	–	–	–
Show software licence keys	yes	yes	–	–	–
Manage security keys	yes	yes	–	–	–
Read the audit log	yes	yes	–	yes	–
View agents and rollout tokens	yes	yes	–	yes	–
Approve and block agents, create rollout tokens	yes	–	–	–	–
Match network findings	yes	yes	yes	–	–
Set up users, sign-in, notifications, status tokens, AI assistant	yes	–	–	–	–
System health and backups	yes	–	–	–	–
Use the AI assistant	yes	yes	yes	yes	yes

Confidentiality of documents

Role	Sees documents up to
Administrator, information security	strictly confidential
Editor, auditor	confidential
Read only	internal

Evidence above one’s own level is only counted in the Grundschutz check, not shown.

Rights per location

With Pro people can be limited to writing at certain locations. Reading stays as the role allows.

Own roles

There are no own roles. The fixed roles keep the rights clear and auditable.