Skip to main content
NOFire AI uses role-based access control (RBAC) to manage what users and API keys can do within your organization. Each user is assigned a role that determines their permissions across the platform. Manage user roles from your Account Settings.

​
Roles Overview

NOFire AI provides four user roles, listed from least to most privileged:
RoleDescription
ViewerRead-only access to view resources and investigations
EngineerCan create and manage investigations and chat threads
AdminCan configure integrations, settings, and Slack
OwnerFull control including user management and API keys

​
Permission Matrix

The table below shows what each role can do:
ResourceViewerEngineerAdminOwner
AccountViewViewViewView, Edit, Delete
UsersView, ListView, ListView, ListFull Control
API Keys———Full Control
InvestigationsView, ListFull ControlFull ControlFull Control
EntitiesView, ListView, ListView, ListView, List
Change EventsView, ListView, ListView, ListView, List
ConnectionsView, ListView, ListFull ControlFull Control
SettingsViewViewView, EditView, Edit
Slack——Full ControlFull Control
Chat ThreadsView, ListFull ControlFull ControlFull Control
Audit Logs———View, List
Full Control includes view, list, create, edit, and delete permissions for that resource.

​
Role Descriptions

​
Viewer

Best for stakeholders who need visibility without making changes.
  • View dashboards, investigations, and entities
  • List resources across the platform
  • Cannot create, edit, or delete anything

​
Engineer

The default role for team members who actively use NOFire AI.
  • Everything a Viewer can do
  • Create and manage investigations
  • Use chat threads for incident analysis
  • Cannot modify integrations or settings

​
Admin

For team leads who manage integrations and platform configuration.
  • Everything an Engineer can do
  • Configure and manage integrations (connections)
  • Modify platform settings
  • Manage Slack integration

​
Owner

Reserved for account administrators with full platform control.
  • Everything an Admin can do
  • Invite, remove, and manage users
  • Create and revoke API keys
  • Access audit logs
  • Delete the account
Every account must have at least one Owner. The user who creates the account is automatically assigned the Owner role.

​
API Key Permissions

API keys have separate permission sets based on their type:
Key TypePermissions
EdgeEntities: view, list, create, edit
MCPEntities, Investigations, Change Events: view, list
API keys cannot manage users, settings, or other API keys regardless of type.

​
Managing Roles

To change a user’s role:
  1. Go to Account Settings → Users
  2. Find the user in the list
  3. Select their new role from the dropdown
  4. Changes take effect immediately
Only Owners can change user roles. Role changes are logged in the audit trail.

​
Best Practices

Follow least privilege: Assign the minimum role needed for each user’s responsibilities. Most team members only need the Engineer role. Limit Owner access: Keep the number of Owners small. One or two per organization is typically sufficient. Use API keys appropriately: Choose the correct key type based on your integration needs. Edge keys for data ingestion, MCP keys for read-only integrations. Review roles regularly: Periodically audit user roles to ensure they still match responsibilities, especially after team changes.
For questions about RBAC configuration, contact [email protected].