Security roles

The security role is the coarse level of an account. It sits beside the roles and does not replace them: roles grant individual rights, the security role decides which basic permissions an account has at all.

It is fixed. Unlike roles, you cannot add another one.

The three levels

Level	Basic permissions
tenant-admin	read data, write data, manage plugins, invoke capabilities, read the audit trail
user	read data, write data, invoke capabilities
display	read data

display is a screen, not a person: the monitor in the corridor showing a dashboard. It is deliberately not allowed to invoke a capability — not even when somebody copies its address and opens it in a browser.

What tenant-admin is needed for

The Settings area and everything inside it is reserved for administrators:

• installing, updating and removing plugins
• managing signing keys and trust anchors
• reading the audit trail (right audit:read)
• loading, uploading and saving templates
• listing the tenant’s roles

Changing it, and the limit

In a user’s detail, under Security role: pick the level, then Set. The change takes effect on the next sign-in.

The downgrade tenant-admin → user is refused when no active administrator would be left afterwards — the same check that also catches deactivating, deleting and removing the admin role.

What sits above the tenant

The operator level of the installation is called the Console and is not part of your tenant. It creates tenants, starts and stops them, and keeps an operational log of its own. It has no route to your business data and does not read your audit trail.

In TrakState the term operator always means the person at the machine, never the party running the installation.