Ntrospect separates identity (who you are — Keycloak SSO with Google, Microsoft, or a local password) from authorization (what you can do — managed under Settings → Users & Access, matched on verified email).
The roles
| Role | Grants |
|---|---|
| obs:admin | Everything, including settings, integrations, retention, agent/gateway config, and user management |
| obs:editor | Create and edit dashboards, alert rules, and synthetic tests; all read access |
| obs:viewer | Read-only access to the entire platform |
| obs:sensors | Environmental sensor views only, scoped to selected sensor classes — deliberately does not include viewer |
The sensors role is the interesting one: it exists so facilities or store staff can watch freezer and cooler dashboards without seeing network topology, flows, or anything else. When granting it, pick the sensor classes the user should see.
Two ways to grant access
- Group rules — every synced member of a directory group (imported from Google Workspace via a Cloud integration) gets the role. Use for teams: one rule for "NetOps → obs:editor" beats forty individual grants that drift.
- Individual users — a single email with a role and auth type (SSO or local). Use for externals, contractors, and the sensors-only crowd.
Group membership syncs with the directory import, so people who leave the group lose access without anyone remembering to revoke it.
Verifying what someone sees
The "Preview as user…" utility renders the platform as a given user would see it — the fastest way to confirm a scoped sensors grant or check what a viewer can reach before sending the invite.
Practical defaults
- Keep obs:admin to a handful of people; it includes credential-touching surfaces (integrations, agent deploy).
- Default new engineering hires to obs:viewer via a group rule; promote to editor when they need to build.
- Use SSO for everyone with a directory identity; reserve local passwords for break-glass and service accounts.