Updated
Team & Roles
Invite team members to your DataRadius workspace and assign roles that control what they can see and do.
How roles work
DataRadius uses role-based access control (RBAC) to determine what each team member can see and do. Every user in your workspace has exactly one role. Roles are collections of permissions — when you check what a user can do, the system checks their permissions, not their role name.
This means you think in terms of "can this person view payments?" or "can this person manage routers?" rather than memorising which role name maps to which features.
Available roles
| Role | What they can do |
|---|---|
| Owner | Full access to everything, including billing settings, payment credentials, team management, and workspace deletion. There is exactly one owner per workspace. |
| Admin | Everything the owner can do except transferring ownership, deleting the workspace, or modifying billing credentials. Admins manage the day-to-day: routers, plans, subscribers, team members, and settings. |
| Operator | Manage routers, subscribers, and plans. View payments and reports. Cannot access billing settings, payment credentials, or team management. This is the right role for NOC staff and field supervisors. |
| Viewer | Read-only access to dashboards, subscriber lists, payment history, and reports. Cannot create, modify, or delete anything. Use this for accountants, auditors, or managers who need visibility without control. |
Inviting a team member
- Navigate to Settings → Team.
- Click Invite Member.
- Enter their email address and select a role.
- Click Send Invite.
The invitee receives an email with a link to create their account (or log in if they already have a DataRadius account). Once they accept, they appear in your team list with their assigned role.
Pending invitations show in the team list with an "Invited" status. You can resend or revoke an invitation at any time before it is accepted.
Changing roles
To change a team member's role:
- Go to Settings → Team.
- Click the member's row.
- Select a new role from the dropdown.
- Click Save.
The change takes effect immediately. If the member is currently logged in, their permissions update on the next API request — they do not need to log out and back in.
Owners can change any member's role. Admins can change operators and viewers but cannot promote someone to admin or change another admin's role.
Removing a team member
Click Remove next to the member's name in Settings → Team. Their access is revoked immediately:
- Active sessions are terminated.
- API keys they created are deactivated.
- Their actions remain in the audit log with their name and user ID for accountability.
Removed users can be re-invited later. They start fresh with the role you assign on the new invitation.
Audit trail
Every action taken by a team member is logged: who did what, when, and what changed. The audit log is available at Settings → Audit Log.
Logged actions include:
- Subscriber create/update/delete
- Plan create/update/delete
- Router add/remove/reconfigure
- Payment credential changes
- Team member invite/role change/remove
- Settings modifications
Each log entry records the actor (name and user ID), the action, the affected resource, the previous and new values, and the timestamp. Audit logs are retained for 7 years and cannot be deleted or modified by any role, including the owner.
Security recommendations
- Enable MFA for all team members. Go to Settings → Security and toggle "Require MFA for all users." Every team member will be prompted to set up TOTP on their next login.
- Use the least-privileged role. Give operators the Operator role, not Admin. Give accountants the Viewer role, not Operator. If someone does not need to change settings, they should not have the permission to do so.
- Review the team list regularly. When someone leaves your organisation, remove them from the workspace immediately.
- Check the audit log after sensitive changes. If payment credentials or team roles change unexpectedly, the audit log tells you exactly who did it and when.