User Management
The User Management page at /iam/users provides a full UI for managing platform users within your tenant. Access is restricted to users with the iam:write permission (Admin and Manager roles by default).
User Table
The main view is a paginated, searchable table of all users in the tenant. Columns displayed in each row:
| Column | Description |
|---|---|
| Name | User's display name with avatar initials |
| Verified email address used for Auth0 login | |
| Role | Badge showing the user's directly assigned role |
| Groups | Count of groups the user belongs to. Click to expand list. |
| Last Login | Relative timestamp of the user's last Auth0 authentication |
| Status | Active (green) or Inactive (grey) badge. Inactive users cannot log in. |
Search and Filtering
The search bar filters users by name or email in real time (client-side filtering of the loaded page). Pagination is set to 25 users per page with server-side pagination for tenants with large user counts.
Create User
The "Invite User" button opens a modal form with:
- Email — Required. Must be unique in the tenant. Auth0 sends an invitation email.
- Name — Display name for the platform UI.
- Role — Dropdown of available roles. Required.
- Groups — Optional multi-select. User is added to the selected groups immediately.
Edit User
Clicking a user row opens the edit panel (slide-in drawer) showing:
- Profile fields (name, email — email is read-only after creation)
- Role assignment dropdown
- Group membership checkboxes
- Deactivate button (Admin only) — sets
is_active: falsewithout deleting the user
Effective Permissions Panel
The bottom section of the user detail drawer shows a computed Effective Permissions panel. This resolves the user's final permission set by merging:
- User-level overrides
- Union of all group permissions
- Role-level permissions
- Global tenant defaults
Each permission entry shows its source (user, group name, or role name) so admins can trace where each permission comes from.
Admin-Only Access
iam:read permission. Creating, editing, or deactivating users requires iam:write. Deleting users and managing roles requires iam:admin.