Every person in Shellius has exactly one role, and a role is a named set of permissions. Nothing in the product checks for a role by name — a button, a page or an API call is allowed because your role holds a specific permission such as servers.update.

Roles decide what you can administer. Which servers you can connect to is a separate question, answered by access policies. A member with no administrative permissions can still hold wide server access, and an admin gets no server access from the role alone.

Built-in roles

Every organization starts with four roles.

Role	Intended for	Editable
Super admin	Owns the organization. Always holds every permission.	No — locked
Admin	Day-to-day administration: users, policies, Keystore, audit.	Yes
Manager	Manages customers and servers, onboards hosts, sees sessions.	Yes
Member	Views the inventory and requests access to servers.	Yes

Admin, Manager and Member can be edited and later returned to their shipped permissions with Reset to defaults. Built-in roles cannot be renamed or deleted.

A few defaults worth knowing, because they surprise people:

Capability	Permission	Default holders
Delete servers, customers or users	servers.delete, customers.delete, users.delete	Super admin only
Configure SSO, the MFA policy, email and recording storage	settings.sso, settings.mfa, settings.smtp, settings.storage	Super admin only
Change organization-wide access rules	org.access_settings	Super admin only
Export the audit log	audit.export	Super admin only
Rotate the certificate authority	ca.rotate	Super admin only
Skip production approval	access.prod_bypass	Admin, Super admin — and only while the organization switch is on
Watch session recordings	sessions.view_recordings	Admin, Super admin

Required permissions

Permission	Default roles	Allows
users.view	Admin, Super admin	See the user directory.
users.view_reports	Manager and above	See the users who report to you.
users.invite	Admin, Super admin	Create users and send or resend invitations.
users.update	Admin, Super admin	Edit other users' name, email, manager and SSH key.
users.assign_role	Admin, Super admin	Change a user's role.
users.assign_scope	Admin, Super admin	Restrict a user or group to a set of customers.
users.suspend	Admin, Super admin	Suspend or reactivate users.
users.reset_credentials	Admin, Super admin	Send password-reset links and clear login lockouts.
users.revoke_sessions	Admin, Super admin	Sign a user out of every browser and CLI session.
users.manage_identities	Admin, Super admin	See a user's sign-in methods and unlink an SSO account.
users.delete	Super admin	Permanently delete users.
roles.view	Admin, Super admin	See roles and their permissions.
roles.manage	Admin, Super admin	Create, edit and delete custom roles and edit built-in ones.

Add a user

1. Go to Administration → Users and select Add User.

2. Enter the person's name and email, and choose a role.

3. Optionally set a Manager. A user's manager is their fallback approver for access requests. Members cannot be chosen as managers.

4. Choose how they will first sign in under Password setup:

   • send an email invitation so they set their own password, or
   • set a password now and pass it on yourself.

   When the organization has single sign-on configured, the invitation is a "sign in with SSO" email instead and there is no password to set.

5. Save.

An invitation link is valid for 7 days. Use Resend invite to issue a new one.

Email is not configured yet?

If Shellius cannot deliver the invitation, it shows you the invite link after saving so you can send it yourself. Set up email delivery to avoid that.

Manage an account

From a user's row or detail view:

Action	What it does
Edit details	Name, email, manager. Changing the role needs users.assign_role.
Upload SSH Key	Store the user's public SSH key on their account.
Send password reset	Emails a reset link. Passwords can never be set for someone else directly.
Unlock account	Clears a lockout after too many failed sign-ins.
Sign out all sessions	Ends every browser and terminal-client session the user has.
Sign-in methods	Shows whether they have a password and which SSO accounts are linked. See Single sign-on.
Deactivate	Suspends the account and signs the user out everywhere.
Delete	Permanent. Shows what will be affected first.

Suspend rather than delete when someone leaves. A suspended account keeps its history attached to a real name, and deleting a user also deletes their personal vault.

Restrict a user to certain customers

With users.assign_scope, the Access scope field limits a user — or a whole group — to a chosen set of customers. They then see and act only on those customers and their servers.

You can only grant customers that are inside your own scope, and a super admin can never be scoped.

Create a custom role

1. Go to Administration → Roles and select New role.
2. Name it, describe what people with this role do, and optionally choose an existing role under Start from to copy its permissions.
3. Choose what the role is Based on: Member, Manager or Admin.
4. Save, then tick the permissions the role should hold. Permissions marked sensitive carry a warning because of their impact.

The Matrix view shows every role against every permission, which is the quickest way to compare them.

What "Based on" is for

The base tier is how the rest of Shellius sees a custom role wherever a tier rather than a permission is needed: access policies that target a role, and approver lists that name a role, match on it. A custom role based on Manager is treated as a manager there.

It grants nothing by itself. Permissions come only from the boxes you tick.

Deleting a role

A custom role that still has users cannot be deleted until you choose another role to move them to.

No-escalation rules

Role management is built so that it cannot be used to gain power.

• You can only grant permissions you hold yourself, and a role's base tier cannot be above your own.
• You can only create, edit, assign or delete a role — or manage a user who holds it — when that role's permissions are a subset of yours and its tier is not above yours. An admin therefore cannot edit, suspend or reset a super admin.
• Nobody can edit or delete the role they hold, and nobody can change their own role.
• The Super admin role always has every permission and cannot be edited.
• The last active super admin cannot be demoted or suspended. Promote someone else first.

New permissions after an upgrade

When a release adds a permission, Shellius grants it to your existing roles at startup according to each role's base tier, matching the shipped defaults. Your other customisations are left alone. Review Administration → Roles after an upgrade if you keep tight custom roles.

Next steps

Access policiesDecide which servers people can reach, and for how long.GroupsOrganise users for policies, approvals and customer scope.Single sign-onLet people sign in with your identity provider.Two-factor authenticationRequire a second factor at sign-in.