Roles & permissions

Camper uses per-tenant roles on platform membership. One login can belong to many tenants with different roles in each.

Role	How they usually get it	What they can do
Owner	First invite / SCIM Owner	Full operator UI (same as admin today)
Admin	SCIM Admin, or invite	Connections, identity providers, resource links, operator invites, reconcile
Member	SCIM Member / invite	Limited; not the full control plane
Viewer	Default for every active SCIM User	My Access + account settings

Operators vs workers

• Operators (owner / admin) see the full sidebar: Org Units, People, Resources, Activity, Connections, Settings.
• Workers (viewer, and non-elevated members) see My Access — the pane of glass for “what do I have access to?”

SCIM is the preferred way to elevate and demote. See SCIM provisioning for the roles attribute catalog.

Mutations are role-checked

Dashboard server actions that change tenant state (mint SCIM token, connect a target, link a resource, retry dead tasks, invite operators, …) require owner or admin. Session alone is not enough — a viewer cannot call those actions successfully even if they craft a request.

Connect with Google / Slack also mints a short-lived signed start grant for the API OAuth URL. Opening /api/…/oauth/start with only a tenant slug no longer works.

Reads stay tenant-scoped via the session’s active organization (membership or time-boxed support grant).

Sessions

Under Settings → Account → Active sessions you can:

• See devices signed in with your account
• Revoke a single session
• Revoke others (sign out every device except this one)

SCIM deactivation also revokes sessions for that tenant immediately.

Related

• SCIM provisioning — roles attribute
• Enterprise SSO — how people authenticate
• My Access