PrivateNexus uses a five-level role hierarchy, enforced at the middleware level on every request — not just hidden in the UI.
| Role | Typical user | What they can do |
|---|---|---|
| Viewer | Any authenticated staff member | Read-only — service health and status boards |
| Operator | On-call / technical staff | Trigger restarts, run health checks, set maintenance windows |
| Admin | Infrastructure lead | Manage services, approve Discovery finds, view the full audit log |
| SuperAdmin | Platform owner | Tenant configuration, integration setup, role assignment |
| BreakGlass | Emergency recovery only | Bypass-capable access for genuine incidents — heavily logged, and the only role that can activate Security Lockdown Mode's Full tier |
Authentication is handled via Keycloak (OpenID Connect) — sessions are backed by Redis with an 8-hour cookie. There's no separate PrivateNexus password to manage; your identity provider is the single source of truth.
If you're running PrivateNexus as a single operator, see Governance & Approvals — the dual-control approval requirement automatically relaxes when no second reviewer exists on your account, so you're never blocked from approving your own routine actions. It re-tightens the moment a second real person is added.