Roles

A role is a named bundle of permissions, and it's the piece that makes access in Tines 3B practical to manage. Rather than handing out individual permissions one at a time, you grant someone a role, and that role carries a sensible set of permissions with it.

Under the hood, Tines 3B's access control is made of fine-grained permissions like "read a space" or "use a connector." Roles group those permissions into meaningful sets so you don't have to think in terms of the individual pieces. When you give a member or group access to something, you pick a role, and the role decides exactly what they can do.

Each role is tied to a specific kind of resource. There are roles for spaces, roles for connectors, roles for skills, roles for networks, roles for groups, and roles for service accounts.

A role only fits the kind it was made for, so you can't accidentally assign a space role to a connector. This keeps the choices you see relevant, so when you're sharing a connector, you're only ever offered connector roles.

Tines 3B ships with built-in roles that cover the common needs for each resource, usually as a small ladder from least to most access. For spaces, for example, there's a viewer who can look, an editor who can build and run, and a manager who administers the space and its access. Connectors follow a similar shape with a viewer, a user who can actually use the connector in workflows, a sharer who controls its access, and an editor who changes its settings. Skills, networks, groups, and service accounts each have their own equivalent tiers.

Alongside these, there's a set of tenant-level creator roles: the ability to create new spaces, connectors, skills, networks, groups, or service accounts. These aren't about one specific resource but about being allowed to make more of that kind in the first place.

One role stands apart: the tenant admin. It carries a permission that short-circuits every access check, so an admin can do anything in the tenant.

Because it's so powerful, it's treated differently from the others. It isn't offered in the normal role picker the way viewer or editor roles are, and no custom role you build can ever include that all-access permission. Tenant admin access is deliberately kept as its own thing.

When the ready-made roles don't match how your team works, you can define your own. A custom role is scoped to a single kind of resource, just like a built-in one, and you choose exactly which permissions it includes, as long as it grants at least the ability to view that resource.

Once created, a custom role appears alongside the built-in roles wherever you assign access for that kind, so it behaves like a first-class option. Creating and managing roles is an administrative capability, reserved for people with the right tenant permission.

Roles also smooth out creating things. When you make a new resource, Tines 3B grants you the roles you need to both run it and manage it, without any extra setup. Create a space, for instance, and you're made its manager and its editor at once, so you can start building immediately and control who else gets in. This means the person who creates something is never locked out of it.