Skip to main content
Origin ships eight built-in roles. This page lists what each role covers and how to invite people into your tenant.

​
The eight built-in roles

For a row-by-row breakdown of what every role can reach — endpoints, event content, prompt text, analytics, directory data, signals, and administration — see Access Control.

​
Sensitive data is gated separately

Every analytics column is classed Default or Sensitive. Default covers metadata — timestamps, model names, identifiers, counts, status. Sensitive covers anything that exposes private content in bulk, and reading it needs a dedicated permission on top of the role’s normal read. A query that references a sensitive column — in a result, a filter, a grouping, or a sort — without the matching permission is refused before it runs. A role that can’t read a sensitive column never even sees it in the schema, so it can’t build a query that touches one, and it can’t probe values by guessing.
AI prompt text is treated as the most sensitive surface in the product. Grant Detection Engineer to people who tune detections — not as a general power-user role.

​
Choosing a role

Start from least privilege and add capability only where a person’s job requires it.
  • Start from least privilege. Give analysts SecOps; add Detection Engineer only for the people who genuinely need to read prompt and payload content.
  • Viewer is read-only, not read-everything. Auditors and execs see metadata, counts, and configuration — never sensitive content or raw rows.
  • IT / Fleet Admin runs the fleet, not investigations. It manages endpoints and provisioning but has no event or analytics access.
  • Treat Tenant Admin like root. It holds destructive operations and all sensitive content. Keep the holder count small.
  • Use Vendor Support for outside help that needs deployment health but must never see monitored content, and No Data Access for training accounts that should see nothing.

​
The User Management view

Open Admin → Access at dashboard.originhq.com. The table lists every user in your tenant. Use the search box to filter by email, name, or role, and Columns to change which columns are visible. Each row carries three actions: Change role, Reset PW, and Remove.
Only Tenant Admin can invite users, remove users, or change a user’s role.

​
Inviting a user

1

Open Access

Sign in at dashboard.originhq.com, click Admin in the far-left rail, then select Access.
2

Open the invite dialog

Click Invite user at the top right.
3

Enter the email and pick a role

Type the user’s email address, then choose a role from the dropdown. It lists all eight built-in roles and defaults to Viewer.The dialog shows the selected role’s description beneath the field, so you can confirm the reach before sending.
4

Send the invite

Click Send invite. The user receives a WorkOS invitation email and joins the organization once they accept.
The invite dialog collects an email and a role only.