Roles and Permissions
Maximus is multi-tenant. Each user belongs to one or more organizations with a per-org role.
Application route
—Sidebar
Welcome → Roles
RolesPMSMEAdminPlatform Admin
| Role | Label in UI | Capabilities |
|---|---|---|
| pm | PM | Read-only across most modules; view dashboards, generate/export reports |
| sme | SME (operator) | Create/edit engagements, findings, scans; run tests; access CLI Connections |
| admin | Admin | Everything SME can do + user management, invitations, org settings, integrations, LLM |
| platform_admin | Platform Admin | Cross-org access; create organizations; System tab (updates, deployment policy) |
Access matrix
| Feature | PM | SME | Admin | Platform Admin |
|---|---|---|---|---|
| View dashboards & reports | ✓ | ✓ | ✓ | ✓ |
| Create engagements / edit findings | ✗ | ✓ | ✓ | ✓ |
| Threat modeler canvas (write) | ✗ | ✓ | ✓ | ✓ |
| Settings (`/settings`) | ✗ | ✗ | ✓ | ✓ |
| Users & invitations | ✗ | ✗ | ✓ | ✓ |
| CLI Connections (`/devices`) | ✗ | ✓ | ✓ | ✓ |
| Create new organization | ✗ | ✗ | ✗ | ✓ |
| System updates & deployment policy | ✗ | ✗ | ✗ | ✓ |
Organizations are fully isolated tenants. Data does not leak across org boundaries.