Define what each role can see and do in the portal. Every role other than System Admin starts with no permissions until a System Admin enables them.
| Role | Description in the portal | Default permissions |
|---|---|---|
| System Admin | Oversees and manages the entire CodeSign Secure platform, ensuring system integrity, security, and accessibility. | Enabled for platform administration. Review the list after installation. |
| Project Manager | Coordinates application timelines, resources, and team collaboration to meet project objectives efficiently. | None |
| Security Officer | Focuses on implementing and maintaining robust security measures to protect data and manage platform vulnerabilities. | None |
| Auditor | Conducts thorough reviews and audits of platform processes and security to ensure compliance with standards and regulations. | None |
| Developer | Maintains platform features, working on software development and signing operations. | None |
Important: Until a System Admin enables permissions for a role, users with only that role can’t use the related features. Enable permissions before you assign roles to users.
For the Certificate Owner and Quorum policies, approvers must hold the System Admin or Project Manager role, or both. Quorum members can only be chosen from users with these roles.
Right-click a role to open its options.
View Details lists every permission currently assigned to the role.
Edit Permissions lets you switch each permission on or off. Hover over a permission to see what it controls, then select Update.
The portal’s hover text is the authoritative description of each permission.
| Permission | Allows the user to | Portal area |
|---|---|---|
| Application creation | Create and edit applications | App Management |
| Environment creation | Create and edit environments and their approval policies | System Setup > Environment |
| Signing requests decision | Approve or deny signing requests | Signing Request |
| Sign tools | Open the Signing Tools download page | Signing Tools |
| Email Configuration | Add and manage SMTP sender configurations | System Setup > Email > Config |
| Email Template | Create and manage email templates | System Setup > Email > Template |
| Team Management | Create teams and manage their members | App Management |
| Upload SSL/TLS Certificate | Generate a CSR and import the portal TLS certificate | System Setup > SSL/TLS Management |
| Create Self-Signed Certificates | Create self-signed signing certificates | Keys and Certificates |
| Generate CSR | Generate a key pair in the HSM and a certificate signing request | Keys and Certificates |
| Import Certificates | Import CA-issued certificates | Keys and Certificates |
| SSL Authentication certificate creation | Generate client authentication certificates | System Setup > User |
| API Key creation | Generate API keys | System Setup > User |
| Backup Dump | Schedule, download, and restore backups | System Setup > Backup |
| Register User | Register new users | System Setup > User |
| Origin verification configuration | Configure signing projects for reproducible-build hash validation | System Setup > Signing Projects |
| View reports | Open the Reports section | Reports |
| View logs | Open the Logs section | Logs |
| Download Syslog Report | Download system logs from the Reports area | Reports |
| Download Syslog Logging | Download system logs from the Logs page | Logs |
| User Role Assign | Change the roles assigned to users | System Setup > User |
| Add Identity Store | Add and manage the Azure AD identity store | System Setup > Identity Store |
| Activate License | Update the product license | Profile > License |
| CodeSigning Operation | Sign with CodeSign Secure client tools | Client tools |
| API Access | Use the CodeSign Secure REST API | API |
| Integrate Plugins | Configure, connect, and disconnect plugins | System Setup > Plugins |
Separate the people who administer the platform, look after keys, approve signing, request signing, and audit activity.
| Role | Suggested permissions |
|---|---|
| System Admin | Add Identity Store, Email Configuration, Email Template, Upload SSL/TLS Certificate, Backup Dump, Integrate Plugins, Activate License, Register User, User Role Assign |
| Security Officer (key custodian) | Create Self-Signed Certificates, Generate CSR, Import Certificates, Environment creation, Origin verification configuration, View logs, View reports |
| Project Manager (application owner and approver) | Application creation, Team Management, Signing requests decision, View reports |
| Developer (requester or pipeline) | CodeSigning Operation, Sign tools, and API Access if the pipeline calls the API |
| Auditor | View reports, View logs, Download Syslog Report, Download Syslog Logging |
Keep at least two named System Admins.
Make sure the people who submit production signing requests aren’t the only eligible approvers.
Give automation its own API users with only CodeSigning Operation, and API Access where needed.
Review roles and assignments every quarter and after organizational changes.