Users & Roles
The Users page (Superadmins only see the full management view; other roles see it read-only) lists everyone on your account and lets a Superadmin add, suspend, or reconfigure teammates.
Every user has exactly one base role:
| Role | Access |
|---|---|
| Superadmin | Full, unrestricted access to every feature. Bypasses granular permissions entirely. |
| Technician | Standard operator access. Can be granted additional granular permissions individually. |
| Read-Only | View-only by default. Can also be granted additional granular permissions individually. |
A Superadmin can’t change their own role or deactivate their own account — that has to be done by another Superadmin.
Adding a teammate
Section titled “Adding a teammate”Only a Superadmin can add users, from + New User on the Users page. Creating an account requires a username and password (minimum 8 characters, longer with more character variety if your account has the strong-password policy enabled) — email and role are optional, with new users defaulting to Read-Only. There’s no email invite flow: the account is created and ready to use immediately with the credentials you set.
The number of users your account can have is set by your plan (see Billing & Plans). Adding a teammate past that limit is refused — upgrade to add more.
Granular permissions
Section titled “Granular permissions”Beyond their base role, Technicians and Read-Only users can be granted specific permissions individually — things like managing users, deregistering agents, approving high-risk remediation actions, editing platform settings, or viewing the audit log. Select a user, check the permissions to grant, and save. Superadmins always have every permission and can’t be restricted.
Managing existing users
Section titled “Managing existing users”From a user’s detail panel, a Superadmin can change their base role, suspend or reactivate their account, and adjust their granular permissions. Suspending a user revokes their active sessions and blocks login immediately. Password resets and forced session logout are handled from Settings → Users.
Confirming dangerous actions
Section titled “Confirming dangerous actions”Some actions can destroy data or interrupt a machine, so being signed in is not enough. These ask you to re-enter your password (and your authenticator code, if you use one) before they run:
- Deactivating a user
- Deregistering an agent from Settings
- Self-destructing an agent, and queuing a process kill or other remediation
After a successful confirmation you are not asked again for 5 minutes, so a sequence of related actions isn’t interrupted. A wrong password never signs you out, but repeated failures lock the account for a while, exactly as at login. Confirmations and failures are recorded in the Audit Log.
Two special cases: if your account is managed by your company’s single sign-on or directory (SSO, LDAP), there is no Guardian password to re-enter — your identity provider has already authenticated you, so these actions go ahead after the normal confirmation. And when a Guardian operator is impersonating a user for support, dangerous actions are blocked entirely.