Skip to main content
Origin ships eight built-in roles covering the operating personas a security program runs. This page explains how access is granted, what each role can reach, and how to invite people into your tenant.

​
How access is granted

Every user holds one or more grants. A grant pairs a person with a role:
Every role applies across the whole tenant. Nothing about a role is implicit — if a capability isn’t granted to a role, that role can’t reach it.

Roles stack

A person can hold more than one grant. Permissions union — the user gets everything any of their roles allow.

Sensitive content is separate

Reading metadata and reading actual prompt or payload content are different permissions. A role can see that activity happened without seeing what was said.
A user with no explicit grant defaults to a single Viewer grant.

​
The eight built-in roles

Five roles work with monitored data; three are operational or limited.

​
Data-facing roles

​
Operational and limited roles

These three are defined by what they can’t reach.
For a row-by-row breakdown of what every role can reach — endpoints, event content, prompt text, analytics, directory data, signals, and administration — see Access Control.

​
The User Management view

Open Settings → User Management at dashboard.originhq.com. The table lists every user in your tenant. Use the search box to filter by email, name, or role, and Columns to change which columns are visible. Each row carries three actions: Change role, Reset PW, and Remove.
Only Tenant Admin can invite users, remove users, or change a user’s role.

​
Inviting a user

1

Open User Management

Sign in at dashboard.originhq.com, click Settings in the far-left rail, then select User Management.
2

Open the invite dialog

Click Invite user at the top right.
3

Enter the email and pick a role

Type the user’s email address, then choose a role from the dropdown. It lists all eight built-in roles and defaults to Viewer.The dialog shows the selected role’s description beneath the field, so you can confirm the reach before sending.
4

Send the invite

Click Send invite. The user receives a WorkOS invitation email and joins the organization once they accept.
The invite dialog collects an email and a role only.

​
Sensitive data is gated separately

Every analytics column is classed Default or Sensitive. Default covers metadata — timestamps, model names, identifiers, counts, status. Sensitive covers anything that exposes private content in bulk, and reading it needs a dedicated permission on top of the role’s normal read. A query that references a sensitive column — in a result, a filter, a grouping, or a sort — without the matching permission is refused before it runs. A role that can’t read a sensitive column never even sees it in the schema, so it can’t build a query that touches one, and it can’t probe values by guessing.
AI prompt text is treated as the most sensitive surface in the product. Grant Detection Engineer to people who tune detections — not as a general power-user role.

​
Choosing a role

Start from least privilege and add capability only where a person’s job requires it.
  • Start from least privilege. Give analysts SecOps; add Detection Engineer only for the people who genuinely need to read prompt and payload content.
  • Viewer is read-only, not read-everything. Auditors and execs see metadata, counts, and configuration — never sensitive content or raw rows.
  • IT / Fleet Admin runs the fleet, not investigations. It manages endpoints and provisioning but has no event or analytics access.
  • Treat Tenant Admin like root. It holds destructive operations and all sensitive content. Keep the holder count small.
  • Use Vendor Support for outside help that needs deployment health but must never see monitored content, and No Data Access for training accounts that should see nothing.