Users, Roles + Access

Rayven's access control model combines role-based permissions with Label-based data scoping to provide granular, scalable access governance without building separate applications per audience.

Roles control what users can do. Labels control what data they can see. Together, they enable a single application to serve operators, managers, clients + partners with precisely the right level of access - without manual data filtering or separate view configurations per user group.

SSO, MFA + enterprise IdP integrations ensure access governance integrates with your existing identity infrastructure.

Role-based access control (RBAC)

Define roles that control what users can see + do within the platform. Standard roles include Admin, Builder + Viewer, with configurable fine-grained permissions per workspace. Role assignments determine which capabilities, configuration options + data operations each user can perform.

Label-based data access

Complement role-based permissions with Label-based data scoping. A user's Label assignment controls which data records they can see across dashboards, workflows + API endpoints. Site managers see their site. Clients see their records. Managers see aggregated views. All from the same application.

SSO + enterprise IdP integration

Support for OAuth2/OIDC, SAML + enterprise identity providers including Azure Active Directory/Entra ID. Users authenticate through your existing identity infrastructure. No separate Rayven credentials required for organisations with centralised identity management.

Multi-factor authentication (MFA)

MFA is available across all authentication methods. Enforce MFA for all users or specific roles within a workspace. Adds an additional verification step to the login process, protecting access to operational data + platform configuration.

Workspace-level isolation

User permissions, role assignments + data scoping operate at the workspace level. Different workspaces can have different user sets, permission configurations + data scopes within the same platform instance - supporting multi-team or multi-client isolation.

SCIM provisioning + user lifecycle

SCIM provisioning (where configured) enables automated user account management via your existing identity provider. User onboarding, role assignments + deprovisioning are managed centrally through your IdP rather than manually within the platform.

Users, Roles + Access is the permission layer governing every interaction with the platform across all other layers.

Role assignments determine which Integration Layer connectors, Data Layer tables + Execution Layer workflows each user can view or modify.
Label-based data access controls which records each user sees in Presentation Layer dashboards, reports + interfaces.
SSO configurations integrate with your organisation's existing identity infrastructure for unified authentication.
All user actions - login events, configuration changes, workflow executions + data access - are captured in Audit Trails + Logs.

Standard roles include Admin (full platform access), Builder (workflow + configuration access) + Viewer (read-only access to dashboards + interfaces). Fine-grained permissions can be configured per workspace within these roles to tailor access to specific capabilities.

Role-based access controls what actions a user can perform (view, configure, administer). Label-based access controls which data records a user can see. Both work independently and together - a Viewer with a specific Label can only view data matching their Label assignment.

Yes. SSO is supported via OAuth2/OIDC, SAML + enterprise identity providers including Azure Active Directory/Entra ID. Users authenticate through your existing identity infrastructure. Separate Rayven credentials are not required when SSO is configured.

Yes. MFA is available across all authentication methods. It can be enforced for all users, specific roles or specific workspaces based on your security policy requirements.

Yes. Label-based data access scopes each user's view to the data matching their Label assignment. Role-based permissions control which elements they can interact with. The same application layout serves different audiences with automated data + permission scoping.

SCIM provisioning connects Rayven's user management to your identity provider. When configured, user accounts are created, updated + deprovisioned automatically based on IdP changes. Contact us to discuss SCIM configuration for your specific identity provider.

Yes. A user can have Builder access in one workspace and Viewer access in another, or no access to specific workspaces at all. Workspace-level isolation applies independently per workspace within the same deployment.

User accounts can be manually deactivated within the platform, removing access immediately. With SCIM provisioning configured, deprovisioning in your IdP triggers automatic deactivation in Rayven - no manual IT intervention required.

User count limits depend on your subscription tier. Contact us to confirm the applicable user count for your deployment.

Yes. All login events, permission changes + user actions are captured in Audit Trails + Logs with user identity + timestamp. Access event logs are available for compliance reporting + security investigations.

Partners

Sectors

Job Roles

Enterprise

Library

Our Company

Users, roles + access.

The right access for every person, every dataset.