Your Team

Three Roles, Deliberately

Three roles, deliberately. Enough to separate who can change the rules from who can work the queue, without a permissions matrix nobody maintains.

Role	Can Do
Admin	Everything, including SSO, members, integrations, and the audit log.
Operator	The daily work: projects, scans, triage, policies, and scan configuration. Not organisation settings.
Viewer	Read everything they have access to. Records no decisions.

Add someone from Settings → Members; they sign in with your existing SSO, so there’s no password to issue.

Roles can be changed at any time. Earnie hides what a role cannot do rather than showing disabled buttons, so if a control isn’t there, that’s why.

Capability	Admin	Operator	Viewer
View findings, scans, policies	✓	✓	✓
Run scans	✓	✓	—
Record triage decisions	✓	✓	—
Create and change policies	✓	✓	—
Request a policy approval	✓	✓	—
Approve or reject a request	✓	—	—
Generate SBOM snapshots, render Attribution Documents	✓	✓	—
Scan configuration	✓	✓	view
Manage members	✓	—	—
SSO configuration	✓	—	—
Connect / disconnect integrations	✓	view	—
Organisation audit log	✓	—	—
API keys	all	own	—

Members aren’t the only way to authenticate against Earnie, the next step is setting up API keys for your pipelines and scripts.

⌘I