Access control
Roles, per-person extras and revokes, custom roles, role preview and personal API keys.
How access works
Access answers one question: who may do what, in which project? A grant gives a user or a group a role in a project. A grant can also carry extras (single permissions added on top of the role) and revokes (single permissions taken away). Revokes are applied last and always win, even across several grants.
Built-in roles
| Role | Intended for |
|---|---|
| Organization Admin | Full control across the organization, including identity and billing |
| Project Admin | Full control within a project, including member management |
| Service Desk | 1st-level support: see and create all VMs, power-cycle and hard-stop them, but never delete |
| Operator | Day-to-day work on owned VMs: power, console, snapshots and restores |
| Backup User | Restore from existing backups, never create or delete them |
| Viewer | Read-only access to owned VMs, snapshots and backups |
Built-in roles are locked. Duplicate one to customize it, or build a custom role from scratch with per-category select-all, a permission search and markers on dangerous permissions. Creating and editing custom roles needs members.manage.
The Members page
- Groups, Users and Roles tabs with search and filters by source, role and group.
- Each grant shows its role and how many extras and revokes it carries; expanding it lists the exact permissions.
- The effective-permissions panel lists every permission a person ends up with, granted or denied, with dangerous ones highlighted.
- Users, groups and roles each have a detail page: permission matrix, group membership, the person's VMs and their activity. A role's page lists everyone who uses it.
- Viewing needs members.view; changing anything needs members.manage.
Grant someone access
- 1Open Members and choose the Users (or Groups) tab.
- 2Add the user: local, Active Directory (domain plus account name, with directory lookup) or Entra ID (object ID). New principals start as Viewer.
- 3Open the user's detail page and pick the role on the Permissions tab, for example Operator or Service Desk.
- 4Fine-tune in the permission matrix: switching a permission on writes an extra, switching it off writes a revoke. Both are stored on the grant, not on the role.
- 5Check the result in the effective-permissions panel, or use role preview to see the portal as that role.
Role preview
Admins can switch their own session to any preset role to see the portal the way that role sees it, before assigning it to anyone. Every change made on the Members page is itself recorded in the Activity log with actor and target.
Personal API keys
- Create API keys on your Profile page for scripts and CI pipelines that call the Verlocx REST API (documented separately on this site).
- Give each key a name and an expiry: 30 days, 90 days, 1 year or no expiry. The token is shown once and cannot be displayed again.
- A key never exceeds the permissions of the person who owns it, and can be revoked at any time. Keys show as Active, Expired or Revoked.
- Managing keys needs apikey.manage.
Features on this page
- Fine-grained permissions
- Built-in roles
- Custom roles
- Extras and revokes
- Effective permissions
- Role preview
- REST API
- Personal API keys