RedStrikeby Encyfr

Reference

Roles & Permissions

The RedStrike role model — owner, admin, analyst, and viewer — and exactly what each role can do.

2 min read

RedStrike uses role-based access control (RBAC) scoped to each organization. Every member has one role that determines what they can see and do.

TL;DR

Four roles: Owner (full control incl. billing), Admin (manage targets, scans, members), Analyst (run scans and triage findings), Viewer (read-only). Roles are per-organization; a user can hold different roles in different orgs.

The roles

RoleIntended for
OwnerFounders / security leads who own the account
AdminSecurity engineers managing the program
AnalystTesters and triagers doing day-to-day work
ViewerAuditors, stakeholders, read-only access

Permission matrix

CapabilityOwnerAdminAnalystViewer
View findings & reports✓✓✓✓
Run & schedule scans✓✓✓—
Triage / dismiss findings✓✓✓—
Add / verify targets✓✓✓—
Connect cloud accounts✓✓——
Manage integrations✓✓——
Invite / remove members✓✓——
Change member roles✓✓——
Manage billing✓———
Delete organization✓———

Only an Owner can manage billing or delete the organization. There must always be at least one Owner — the last Owner cannot be demoted until another is promoted.

Assigning roles

Owners and Admins manage membership under Settings → Members:

  1. Invite by email; the invitee picks a role on acceptance (or you set one).
  2. Change roles from the member list at any time.
  3. Remove a member to revoke all access immediately.

API keys and service access

Automation uses API keys, which carry a role of their own. Create scoped keys under Settings → API keys and prefer the least-privileged role that still lets the automation do its job:

CI pipeline key   → Analyst  (run scans, read findings)
Read-only export  → Viewer   (fetch reports only)

Treat API keys like passwords. Store them in a secrets manager, never in source control, and rotate them regularly. Revoke a key immediately if it leaks.

Multi-organization users

A user can belong to several organizations with a different role in each — for example, Admin in your own org and Viewer in a client's. Switch orgs from the account menu; permissions always reflect the active organization.

Next