# Role Based Access Control **Roles** in CertiNext define *what actions a user is allowed to perform* across the platform. They are the primary mechanism for enforcing **least-privilege access**, separation of duties, and operational governance in certificate and key lifecycle management. CertiNext provides both **predefined system roles** and the ability to create **custom roles** with fine-grained permissions, allowing organizations to align access controls precisely with real-world responsibilities.
#### Role-Based Access Control (RBAC) CertiNext uses a **role-based access control (RBAC)** model where permissions are grouped into logical functional areas such as: * Certificate lifecycle operations * Certificate Authorities and CA connectors * Discovery and inventory * Keys and key stores * Automation, bots, and provisioning * Orders, renewals, and revocations * Financial and billing operations * User, group, and policy administration * Reporting, audit logs, and compliance views Each role represents a curated set of permissions across these areas, ensuring users only see and act on what is relevant to their job function. *** #### Predefined Roles CertiNext includes predefined roles to support common enterprise use cases, such as: * **Administrator** – Full platform access, including configuration, CA management, policies, users, and billing * **Manager** – Oversight of certificate operations, approvals, and reporting without full administrative control * **Standard / Basic Users** – Limited certificate request and operational capabilities * **Discovery Users** – Restricted access focused on certificate discovery and inventory management These roles accelerate onboarding while enforcing strong governance by default. *** #### Custom Roles For more advanced or regulated environments, CertiNext supports **custom role creation**, allowing administrators to define roles tailored to specific operational needs. When creating a custom role, administrators can: * Enable or disable permissions at a granular level * Control access to individual modules and actions (e.g., renew certificates, revoke certificates, manage discovery bots) * Combine read-only and action-based permissions * Activate or deactivate roles as needed This allows organizations to model roles such as *PKI Operator*, *Security Reviewer*, *DevOps Automation User*, or *Compliance Auditor* with precision.\ Create Custom Role \_ CERTInext *** #### Scope of Permissions Role permissions in CertiNext can span across: * **APIs and automation** (API credentials, bots, provisioning) * **Public and private CAs** (creation, management, suspension, revocation) * **Certificate lifecycle actions** (issue, renew, reissue, revoke, suspend) * **Discovery and CT log monitoring** * **Keys and key profiles** * **Orders and approvals** * **Users, groups, and access controls** * **Reports and audit logs** This ensures that even highly sensitive operations can be delegated safely without granting unnecessary access elsewhere. *** #### Roles, Groups, and Tags Together Roles define *what a user can do*, while **groups and tags** define *where they can do it*.\ CertiNext evaluates access using all three dimensions: * **Role** – permitted actions * **Group access** – permitted organizational scope * **Tag restrictions** – permitted environments or assets This layered model enables strong isolation between teams, applications, and environments while maintaining centralized governance. *** #### Auditability and Governance All role assignments, modifications, and permission changes are: * Logged in audit logs * Traceable to the administrator who made the change * Available for compliance and security reviews This ensures accountability and supports internal and external audits. *** #### Why Roles Matter In certificate and trust operations, overly broad access is a major source of risk. Well-designed roles help organizations: * Prevent unauthorized certificate issuance or revocation * Enforce separation of duties * Reduce human error * Meet compliance and audit expectations * Scale operations safely across teams *** #### Roles as a Governance Control In CertiNext, roles are not just a convenience feature—they are a **core governance control**. By combining fine-grained permissions with auditability and scoped access, CertiNext enables organizations to operate complex public and private trust environments securely, responsibly, and at enterprise scale. #### Session Enforcement on Role Changes **Important:** When a user’s role is modified in CertiNext, the user is **automatically logged out of the application**. This enforced logout ensures that updated permissions take effect immediately and prevents users from continuing an active session with outdated or elevated access rights. The user must sign in again to resume access under the newly assigned role, supporting strong security, least-privilege enforcement, and audit integrity. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.certinext.io/documentation/user-roles-and-access-control/role-based-access-control.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.