Roles & scopes
Authorization is role × scope. Your organization uses tenant scope; CloudPulse staff may use provider scope for support.
Scopes
| Scope | Meaning |
|---|---|
tenant | User belongs to one organization. All data access is limited to that tenant. |
provider | CloudPulse platform staff. Not used for customer logins. |
Roles
| Role | Typical use |
|---|---|
admin | Users, SSO, accounts, full tenant configuration. |
editor | Operational changes (accounts when permitted, Action Center queue, enrichment edits). |
analyst | Analysis-focused access (read + selected write capabilities). |
finops | Cost / budget oriented capabilities. |
viewer | Read-all within grants; no CSV/export; budget notify emails redacted. |
Viewer account grants
Viewers may be limited to specific account_id values. GET /v1/auth/me returns account_ids as a list, or null when unrestricted within the tenant. Empty grants mean empty account pickers — never an unfiltered list of other organizations.
Isolation
- Tenant users cannot read or write another organization’s data.
- Optional support access to your estate is controlled by your tenant admin (Settings).
- Email digest, Slack, and ServiceNow configuration are managed by your organization only.