Page Comparison

New System Role - System Manager (lower level admin)

Default Permissions / Section Access

• Edition & License - Read Only

• Reporting - Read Only

• User Management - Can Edit

  • Read Only Permissions

• Environment - Can Edit

• Site Configuration - Can Edit

• Authentication - Read Only

• Plugins - Read Only

• Integrations - Can Edit

• Compliance - No Access

• Experimental - No Access

New System Role - User Manager

• Edition & License - No Access

• Reporting - No Access

• User Management - Can Edit

  • Read Only Permissions

• Environment - No Access

• Site Configuration - No Access

• Authentication - Read Only

• Plugins - No Access

• Integrations - No Access

• Compliance - No Access

• Experimental - No Access

New System Role - Read Only Admin

• Read only access to system console

• No Access to Compliance

No System Role (apart from System Admin) should have access to edit system roles

Every change made by any admin needs to be included in the audit log

Chat-facing experience should not be impacted for any users assigned a system role other than System Admin. These Admin roles should have the same permissions as members on chat side (unless they are also team/channel admins - in which case, the higher scoped permissions apply.

e.g. System Manager or User Manager should not be able to

• Convert a private team to public (new permission only for System Admin)

• View email addresses of members if not globally allowed

• Edit/delete others' posts if not globally allowed

Each admin role can be measured per server for usage analysis

Each of the permissions / section access can be granted or removed from a system role (all users with that role have the same access)

Obscure All Stored Credentials

Example: Global Relay

No privilege should be capable of elevating anyone to system admin or impersonating system admin.

Examples:

• Reset admin passwords

• Change admin email addresses

• Modify SAML/LDAP Admin filter

• Installing an unsigned plugin

No privilege should be capable of deactivating or demoting another admin.

Examples:

• Modify SAML/LDAP guest/user filters

No system role can join private channels without being invited. This includes auto-joining private channels via permalink

Telemetry added to track changes to default admin roles:

• Total count of roles not using default privileges