Roles & Access Control
Access to the DB DevOps manager is section-scoped by role. Each role grants a subset of the left-panel sections (Overview, Configuration, Change Management, Schema, Governance, Administration); a user's effective view is the union of sections across all assigned roles, resolved server-side. The IDE is available to every authenticated user and is not section-gated.
Managing Roles
Under Administration → Roles & Access, admins create roles (name + granted sections), edit them, and delete non-system roles. The four built-ins (admin, release_manager, approver, user) are system roles, their granted sections are editable but they cannot be renamed or deleted.
Assigning Roles
Select a user, check the roles to grant, and Save Assignment. Effective permissions are resolved server-side and cached briefly, changes land on the user's next page load.
Default Section Grants
| Role | Sections |
|---|---|
| admin | All six, including Administration. |
| release_manager / approver / user | All except Administration. |
These defaults preserve prior behavior; retune them per team. Federated (SSO) users are mapped to roles by their IdP group claims, see the Identity Providers page.