Managing Roles

Roles are managed in Access Management → Roles. Each user has exactly one role. A role is a set of permissions, an optional list of banned applications, and an optional LDAP group DN.

Screenshot placeholder: Workstation → Access Management → Roles. Role list on the left; permission checklist and LDAP group field on the right.

Only an Owner can create a new role (Add Role). Viewing the page requires View roles. Editing users (assigning a role) is a separate permission on the Users page.

Built-in roles

• Owner — all permissions. Cannot be modified or deleted.

• Guest — no permissions. Cannot be modified or deleted. LDAP users whose directory groups do not map to any role receive Guest for that session.

Custom roles

Give the role a name, then enable the permissions the group of operators actually needs. Changes take effect the next time a session token is issued for an affected user (at most the 12-hour token lifetime).

Optionally set banned applications on the role so that even with View data, those applications are hidden. Individual users can have additional bans; both lists apply.

LDAP group mapping

A custom role may have an LDAP group DN. On each LDAP login, Flopsar compares the user's group memberships (case-insensitive) to these mappings and assigns the matching role. If several groups match, the role with the most permissions wins; ties are broken by role id. If none match, the session uses Guest.

LDAP identities are not stored. Changing a mapping or a directory group takes effect at the user's next login. See LDAP.

Permission catalog

Titles match the Workstation checklist.

Users and access

Permission	Allows
View users	List local accounts
Edit users	Create, edit, lock, or delete local accounts
View roles	Open this page
View LDAP	Read directory settings
Edit LDAP	Change directory settings

Agents and data

Permission	Allows
View agents	See connected instances
Query agents	Run live JVM queries (command line, thread dump, class bytes, and similar)
Switch agent's features	Enable heap dump / thread sampling on an instance
View live	Open Live View
View data	Open Analytics views (browser, analysis, correlation, key-value)
View parameters	See captured method arguments

Profiles and configuration

Permission	Allows
View profiles	Open profiles
Edit profiles	Create, modify, or delete profiles
Edit profiles state	Change draft / ready / active state
Deploy profiles	Deploy, redeploy, or undeploy
Assign applications	Bind applications to profiles
Edit filters	Manage dashboards, charts, and matching rules
Edit data masking	Manage masking patterns
Manage plugins	Install or remove plugins
View plugins	See installed plugins
View plugins source	Open plugin source in the Workstation

License, server, archives, AI

Permission	Allows
View license	See license status and assignments
Update license	Replace the license file
Edit license mappings	Change license-to-application assignments
View server info	Server Details, Stats, and Database
Query server	Refresh server-side listings (for example archives)
Delete application	Remove stored data for an application
View archives	Open Database Archives
Edit archives	Delete archive files
Edit agent tokens	Create and delete PSKs
View AI settings	Open Administration → AI Assistant and read the configuration (secrets are never shown)
Edit AI settings	Change provider, keys, tool policy, proxy/TLS, and reset the token counter
Use AI assistant	Open the analyst chat and AI Analysis; still requires the assistant to be enabled and View data

The Owner role implicitly satisfies every check. Permissions are evaluated with OR logic: if a route accepts more than one permission, holding any of them is enough.