Skip to main content
NOFire AI uses role-based access control (RBAC) to manage what users and API keys can do within your organization. Each user is assigned a role that determines their permissions across the platform. Manage user roles from your Account Settings.

​
Roles Overview

NOFire AI provides four user roles, listed from least to most privileged:

​
Permission Matrix

The table below shows what each role can do:
Full Control includes view, list, create, edit, and delete permissions for that resource.

​
Role Descriptions

​
Viewer

Best for stakeholders who need visibility without making changes.
  • View dashboards, investigations, and entities
  • List resources across the platform
  • Cannot create, edit, or delete anything

​
Engineer

The default role for team members who actively use NOFire AI.
  • Everything a Viewer can do
  • Create and manage investigations
  • Use chat threads for incident analysis
  • Cannot modify integrations or settings

​
Admin

For team leads who manage integrations and platform configuration.
  • Everything an Engineer can do
  • Configure and manage integrations (connections)
  • Modify platform settings
  • Manage Slack integration

​
Owner

Reserved for account administrators with full platform control.
  • Everything an Admin can do
  • Invite, remove, and manage users
  • Create and revoke API keys
  • Access audit logs
  • Delete the account
Every account must have at least one Owner. The user who creates the account is automatically assigned the Owner role.

​
API Key Permissions

API keys have separate permission sets based on their type: API keys cannot manage users, settings, or other API keys regardless of type.

​
Managing Roles

To change a user’s role:
  1. Go to Account Settings → Users
  2. Find the user in the list
  3. Select their new role from the dropdown
  4. Changes take effect immediately
Only Owners can change user roles. Role changes are logged in the audit trail.

​
Best Practices

Follow least privilege: Assign the minimum role needed for each user’s responsibilities. Most team members only need the Engineer role. Limit Owner access: Keep the number of Owners small. One or two per organization is typically sufficient. Use API keys appropriately: Choose the correct key type based on your integration needs. Edge keys for data ingestion, MCP keys for read-only integrations. Review roles regularly: Periodically audit user roles to ensure they still match responsibilities, especially after team changes.
For questions about RBAC configuration, contact [email protected].