Roles and access boundaries
Each person has one role per company. The server checks the current role on every read and every request. Every role sees the whole menu; a screen your role cannot use shows a notice instead of the data or form. Hiding or showing a menu item never grants access.
Customer roles
Section titled “Customer roles”The role names below are the ones shown in Usuários e acessos (users and access). The top bar currently shows the same role in English (for example, Tenant administrator). The table lists company actions; every role, including Leitor, can manage its own preferences, password and backup authenticator in Conta e segurança.
| Role on screen | Can read | Can do in the console |
|---|---|---|
| Administrador da empresa (company administrator) | Everything every other customer role reads: events, assessments, accounts, devices, approximate location, policy, lists, review queue, integration, usage and audit | Full access within the company: everything every other customer role does, plus inviting and managing members. Reveals identifiers and decides privacy requests, always with a recorded reason |
| Analista de risco (risk analyst) | Assessments, accounts, devices, approximate location, policy, lists and the review queue | Search accesses by your company’s ID, run policy simulations, work on review-queue items assigned to them |
| Supervisor de risco (risk supervisor) | Everything the analyst reads, plus usage | Analyst actions plus reassign and reopen review items, set the queue profile, import and approve list versions, request exports, publish the company’s risk rules and use Tudo em fantasma |
| Gestor de integração (integration manager) | Event metadata and integration health | Create applications and server credentials, configure collection and SDK. Does not see assessment content or policy |
| Auditor | Assessments, accounts, review queue, policy, integration, usage and audit | Request exports only |
| Encarregado de dados (DPO) (data protection officer) | Audit | Privacy decisions (retention, legal hold) through the control plane; identifier reveal |
| Leitor (viewer) | Events, assessments, accounts, review queue and policy | Nothing |
Company risk rules. Administrador da empresa and Supervisor de risco publish the application’s risk rules and use Tudo em fantasma in Configuração de risco, each time with a recent authenticator check. Publishing is direct: no second approver and no request to FingerTrackID, and every publication is recorded in the audit trail; measuring the impact first is optional. Every role that reads policy sees the rules and, if measured, their impact. FingerTrackID’s operators never publish or activate a rule for your company; they can only put every rule of an application in ghost, with a recorded reason that your console shows as coming from FingerTrackID support (see internal administration). The managed policy versions are still proposed, approved and published by FingerTrackID’s operations team, with the approval recorded.
Search by your company’s ID. Administrador da empresa, Analista de risco and Supervisor de risco use Buscar titular ou conta pelo ID da sua empresa in the top bar (Busca por ID). The match is exact, each search is recorded in Auditoria, and the ID never goes into the page address. For the other roles the field stays disabled and says why.
Customer actions and outcomes are reported by your backend through the feedback API, not recorded in the console.
Some consequences worth knowing:
- Administrador da empresa has the maximum access within the company: the union of every other customer role. A one-person company needs no second account to reach policy, lists, the review queue or exports. Rules that require a second person still apply: the administrator never approves a request or list version they proposed themselves.
- Only Administrador da empresa reads the member list and invites people.
- Exportações (exports): the administrator and the supervisor can export assessments and device calls; the auditor can export assessments only.
- No customer role sees raw collection payloads, the administrator included.
Application scope
Section titled “Application scope”Most screens read one application at a time, chosen in the top bar. A permission for one dataset does not open the others. A hidden or unavailable field is not an empty fact, a zero score or proof that no data exists. The permissions of a server credential are separate from a person’s console role.
Member changes
Section titled “Member changes”Only Administrador da empresa manages members, in Usuários e acessos:
- Conceder acesso (grant access) invites a person by E-mail, Nome de exibição and Papel na empresa. When the request completes, a person without a console account receives an invitation email on a best-effort basis; a person who already has an account just signs out and in again.
- Reenviar convite (resend invitation), in the Convite column of the member list, sends a new invitation with a new link while it is Pendente: at most 3 times per hour for each person, and not while another one is on its way. Once the person has set a password, the invitation shows Aceito (accepted). Fallback: Esqueceu sua senha? on the sign-in screen.
- Gerenciar o acesso (manage access) offers Trocar o papel, Suspender o acesso, Restaurar o acesso and Revogar o acesso. Revoking is permanent.
Each change is a request, normally approved as soon as it is sent and recorded in the audit trail; access changes only after the request is Concluída (done). The company’s last active administrator is protected. Internal FingerTrackID roles cannot be granted to customer members.
Review and approval
Section titled “Review and approval”List versions keep author and approver separate: the person who imported a version cannot approve it (an authorized supervisor, including the author, may later revoke it). Two accounts belonging to the same person are not two reviewers. An approved version and an active version are different states; approval alone never publishes a policy or enables collection. Company risk rules are the exception to the second-person rule: an administrator or risk supervisor publishes them alone, with a recent authenticator check, and the audit trail records who published what.
Internal administration
Section titled “Internal administration”FingerTrackID’s operators use a separate internal backoffice behind Cloudflare Access and the same password and authenticator checks. Their global authority is separate from customer membership and does not let them read your assessments without a specific authorization. For company risk rules, the only action support can take is to put every rule of an application in ghost, with a recorded reason. Your Configuração de risco screen then shows a notice that FingerTrackID support did it, when and why, without naming the individual operator. Support can never activate a rule or change a weight, band or ruler: Administrador da empresa or Supervisor de risco reactivates the rules by publishing again, and the notice disappears. FingerTrackID’s operators also maintain the default context ruler, the starting point of every company’s context rules, publishing each version with a recorded reason; a new version never changes the rules your company already published.
See console screens and production status.