sencho/docs/features/rbac.mdx

---
title: RBAC & User Management
description: Role-based access control for Sencho - manage admin, viewer, deployer, node admin, and auditor accounts with scoped permissions.
---

<Note>
  Multi-user support requires a **Sencho Skipper** or **Admiral** license. Community Edition supports a single admin account only. Intermediate roles (Deployer, Node Admin, Auditor) and scoped permissions require **Admiral**.
</Note>

Sencho supports role-based access control with five distinct roles. **Admin** and **Viewer** are available on all Pro tiers, while **Deployer**, **Node Admin**, and **Auditor** are exclusive to Admiral.

## Roles

| Role | Description | Tier |
|------|-------------|------|
| **Admin** | Full access to all features: deploy, edit, manage users, configure nodes, and system settings | Skipper+ |
| **Viewer** | Read-only access to dashboards, logs, stats, and file contents | Skipper+ |
| **Deployer** | Can deploy, restart, stop, and start stacks, but cannot edit compose files, delete stacks, or access system settings | Admiral |
| **Node Admin** | Full stack and node management within their scope, but no access to system settings, users, or license management | Admiral |
| **Auditor** | Read-only access like Viewer, plus access to the audit log | Admiral |

### Permission matrix

| Action | Admin | Node Admin | Deployer | Auditor | Viewer |
|--------|-------|------------|----------|---------|--------|
| View stacks, logs, stats | Yes | Yes | Yes | Yes | Yes |
| Deploy / restart / stop / start stacks | Yes | Yes | Yes | No | No |
| Edit compose and `.env` files | Yes | Yes | No | No | No |
| Create and delete stacks | Yes | Yes | No | No | No |
| View nodes | Yes | Yes | Yes | Yes | Yes |
| Add / edit / delete nodes | Yes | Yes | No | No | No |
| Audit log | Yes | No | No | Yes | No |
| System settings | Yes | No | No | No | No |
| User management | Yes | No | No | No | No |
| License management | Yes | No | No | No | No |
| Webhooks | Yes | No | No | No | No |
| API tokens | Yes | No | No | No | No |
| Host console | Yes | No | No | No | No |

## Managing users

Go to **Settings > Users** to view the user list. The table shows each user's username, role badge, creation date, and action buttons.

<Frame>
  <img src="/images/rbac/users-list.png" alt="User Management showing the users table with username, role, and creation date" />
</Frame>

From the user table you can:

- **Edit** a user by clicking the pencil icon
- **Delete** a user by clicking the trash icon (with a confirmation dialog)

You cannot delete your own account. The delete button is disabled for the currently logged-in user.

### Creating a user

Click **Add User** to open the creation form.

<Frame>
  <img src="/images/rbac/user-create-form.png" alt="New User form with Username, Role, Password, and Confirm Password fields" />
</Frame>

| Field | Description |
|-------|-------------|
| **Username** | At least 3 characters. Letters, numbers, underscores, and hyphens only. |
| **Role** | Select from the available roles (see below) |
| **Password** | At least 8 characters |
| **Confirm Password** | Must match the password field |

On Admiral, all five roles appear in the role selector. On Skipper, only Admin and Viewer are available.

<Frame>
  <img src="/images/rbac/role-selector-dropdown.png" alt="Role selector dropdown showing all five roles on Admiral" />
</Frame>

### Editing a user

Click the pencil icon on a user row to edit. You can change the username, role, and optionally set a new password. Leave the password fields blank to keep the existing password.

## Scoped permissions

<Note>
  Scoped permissions require an **Admiral** license.
</Note>

Roles can be scoped to specific stacks or nodes. This lets you grant a user elevated permissions on particular resources without giving them broad access.

Scoped permissions **add to** the user's global role. They never reduce it. A user with a global Viewer role plus a scoped Deployer assignment on the "my-app" stack can deploy "my-app" but has read-only access to everything else.

When editing a user on Admiral, a **Scoped Permissions** section appears below the user form. From there you can:

1. **View** the user's current scoped assignments, each showing the role badge, resource type, and resource name
2. **Add** a new scope by selecting a role (Deployer, Node Admin, or Admin), resource type (Stack or Node), and the specific resource
3. **Remove** an existing scope with the trash icon

### Example scenarios

- A **Viewer** with a scoped **Deployer** assignment on the `frontend` stack can deploy, restart, and stop only that stack.
- A **Deployer** with a scoped **Node Admin** assignment on node "staging-server" can manage stacks and nodes on that server, plus deploy globally.
- A **Node Admin** without any scoped assignments can manage all stacks and nodes but has no access to system settings.

## SSO auto-provisioning

With an Admiral license, users can also be created automatically when they log in via SSO (LDAP, Google, GitHub, or Okta). SSO users appear in the Users list alongside local accounts and are assigned a role based on identity provider group membership or claim mapping.

SSO users cannot log in with a password; they must always authenticate through their identity provider. After SSO provisioning, an admin can add scoped permissions to SSO users just like local accounts.

To set up identity provider authentication, see [SSO Authentication](/features/sso).

## Migration from single-admin setup

When you upgrade to a Skipper or Admiral license, your existing single-admin credentials are automatically migrated. No manual action is required; your login continues to work as before, and your account is assigned the Admin role.

## Account limits by tier

| Tier | Admin accounts | Non-admin accounts | Intermediate roles | Scoped permissions |
|------|---------------|-------------------|-------------------|-------------------|
| **Community** | 1 | 0 | No | No |
| **Skipper** | 1 | 3 | No | No |
| **Admiral** | Unlimited | Unlimited | Yes | Yes |