Product guide

Users & Roles

Guide to Users & Roles: manage panel user accounts, assign roles, configure role-based access control (RBAC) and trace every action in the audit log.

What are Users & Roles?#

The Users & Roles area is the central place for managing panel user accounts and role-based access control (RBAC). It is available only to Administrator users and is reachable from the General navigation menu, the main Settings hub, and the global Spotlight search.

The page is organized into tabs - Team, Permissions, and Audit - so you can jump straight to what you need. The active tab is stored in the URL, which means you can bookmark or share a link that opens on the exact section you want.

RBAC is enforced everywhere

Role permissions are enforced across every module - endpoints, DLP, SSPM, DSPM, threats, reports, and settings. A user can never perform an action their role does not allow, regardless of how they reach it.

Account Settings with profile details, password management, and security controls including 2FA.

1
Open the General menu
In the left navigation sidebar, expand the General section to reveal its sub-items.
2
Go to Settings
Select Settings from the General menu to open the main settings hub.
3
Choose Users & Roles
On the settings hub, open the Users & Roles card. You can also reach it directly via the global Spotlight search by typing "users" or "roles".

Roles#

A role is a named bundle of permissions. Every panel user is assigned exactly one role, and that role defines everything they can see and do. Moftgate ships with built-in roles and supports custom roles for fine-grained control.

Role	Scope
Administrator	Full access to every module and setting, including user management and audit log.
Operator	Day-to-day operations across endpoints, DLP, SSPM, DSPM, threats, and reports. Cannot manage users or roles.
Auditor	Read-only access to dashboards, findings, incidents, and the audit log. No write actions.
Custom	A tailored role with only the permissions you explicitly grant.

The Administrator role cannot be deleted or stripped of user management - there must always be at least one admin.
Operator and Auditor are read-restricted by default; grant write permissions deliberately.
Custom roles start with no permissions and only gain what you explicitly assign.

Team members#

The Team tab lists every panel user account. From here you create new users, assign their initial role, edit details, and remove access when someone leaves the organization.

1
Open the Team tab
Select Team from the Users & Roles tabs to see all panel user accounts. The active tab is reflected in the URL so you can share a direct link.
2
Create or invite a user
Click the add button to create a new panel user. Provide the required details and assign a role. The role determines what the user can see and do across the platform.
3
Edit a user
Click a user entry to update their details or change their assigned role. A role change takes effect immediately for that user.
4
Delete or disable a user
Open the delete action and confirm. A confirmation step prevents accidental removal of team members. Deleting a user revokes all access instantly.

Offboarding

When a team member leaves, delete or disable their account promptly. Deletion revokes all platform access instantly and is recorded in the audit log, while preserving their historical activity for investigation.

Permission management#

The Permissions tab is where role-based access control is configured. Each role lists the actions it is allowed to perform, and you can grant or revoke permissions per role. Changes apply immediately to every user holding that role.

1
Open the Permissions tab
Select Permissions from the Users & Roles tabs to manage role-based access control.
2
Review a role
Each role lists the actions it is allowed to perform. Review the current grants before making changes so you understand the blast radius.
3
Grant or revoke permissions
Toggle or assign permissions for a role. Changes take effect for every panel user holding that role, immediately and across all modules.
4
Save
Permission updates are audit-logged so you can trace who changed access and when. No permission change is silent.

Least privilege

Prefer the narrowest role that lets a user do their job. Grant write permissions only when read access is insufficient, and prefer custom roles over widening a built-in role.

Audit log#

Every action taken in the Users & Roles area is written to the audit log. This creates a tamper-evident trail of who changed access and when, which is essential for compliance and incident investigation.

Event	Meaning
User created	A new panel user account was created and assigned a role.
Role changed	A user’s assigned role was updated.
Permission granted	A permission was added to a role.
Permission revoked	A permission was removed from a role.
User deleted	A panel user account was removed and access revoked.

FAQ#

Who can manage users and roles?

Only Administrator users can open the Users & Roles area. Non-admin roles will not see the Users & Roles card on the settings hub or the entry in Spotlight.

Can I share a direct link to a specific tab?

Yes. The active tab is stored in the URL as a query parameter, so you can bookmark or share a link that opens directly on Team, Permissions, or Audit.

How quickly do role changes take effect?

Immediately. When you change a user’s role or toggle a permission, the new access applies on the user’s next action across every module.

Can a custom role be granted user management?

Yes, but grant it deliberately. A custom role with user management can create or delete other users, so restrict it to trusted personnel only.

Are user and role changes logged?

Yes. Every change made in Users & Roles is recorded in the audit log, including who made the change, what changed, and when.

What happens to a deleted user’s audit history?

The audit log entries remain. Deleting a user revokes access but preserves the historical record of their actions for compliance and investigation.