Roles and access

Roles are held separately from user profile data and are evaluated server-side, so a client can never elevate its own privileges. Membership and access are managed in Settings → Members & access.

• Staff authority and patient authority are separate: a Control Plane session never grants patient access, and patient access never grants workspace access.
• Machine access uses Partner API keys, never staff sessions.
• Sensitive Production actions, such as Production key issuance, additionally require verified multi-factor step-up.