FlowSquad's RBAC Explained: From Global Admin to Read-Only Viewer
Product-level admins, global admins, analysts, reviewers, viewers — a walkthrough of every permission boundary and why they matter for enterprise compliance.
- FlowSquad defines 5 distinct roles with 23 capability categories enforced at both the UI layer and the API layer on every request.
- The Global Admin role controls system-wide settings (LLM config, VectorDB, SSO) and is the only role that can create or delete products — scoped to a maximum of 3 users in recommended security configurations.
- All permission checks generate audit log entries (who accessed what, when, and from which IP), supporting SOC 2 Type II access control requirements with 90-day default log retention.
What Are the 5 Roles in FlowSquad's RBAC System?
FlowSquad's Role-Based Access Control (RBAC) system defines five roles arranged in a hierarchical capability pyramid. Each role is scoped either globally (across the entire FlowSquad instance) or per-product (within a single product workspace). Understanding this hierarchy is essential for designing a secure, auditable user provisioning strategy.
1. Global Admin
Unrestricted access to all system configuration: LLM provider settings, VectorDB connections, SSO/SAML configuration, license management, instance-wide audit logs, and all product workspaces. Can create, delete, and reconfigure any product. Intended for 1–3 individuals (typically the platform owner or DevOps lead).
2. Product Admin
Full control within an assigned product: configure integrations (Jira, Confluence, GitHub), manage product-level LLM overrides, invite and assign users to the product, set workflow tabs (SAFe/Scrum/Kanban), configure branching rules, and approve generated content. Cannot access other products or system-level settings.
3. Analyst
Create and trigger AI generation: run Epic/Story/Task decomposition, initiate code analysis, generate HLD/LLD, create test cases, run quality scans. Can edit and refine generated content. Cannot manage users, configure integrations, or approve final exports to Jira/Confluence.
4. Reviewer
Read all generated content within an assigned product, add inline comments and ratings to Epics/Stories/HLD/LLD, and approve or reject content for export. Cannot trigger new AI generation or modify configuration. Intended for tech leads and architects who review AI output quality.
5. Viewer
Read-only access to finalized, approved content within an assigned product. Can view Epics, Stories, Tasks, HLD/LLD, and test cases but cannot comment, generate, configure, or export. Intended for stakeholders, PMs, and auditors who need visibility without write access.
What Can a Global Admin Do That a Product Admin Cannot?
The distinction between Global Admin and Product Admin is the single most important RBAC boundary in FlowSquad. Product Admins have deep operational control over their product, but they operate within a container whose walls are defined by the Global Admin. The following matrix details the 23 key capabilities and where the boundary falls.
| Capability | Global Admin | Product Admin | Analyst | Reviewer | Viewer |
|---|---|---|---|---|---|
| Configure LLM Provider (global) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Configure LLM Override (product) | ✓ | ✓ | ✗ | ✗ | ✗ |
| Create / Delete Products | ✓ | ✗ | ✗ | ✗ | ✗ |
| Manage Instance Users (all) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Manage Product Users | ✓ | ✓ | ✗ | ✗ | ✗ |
| Configure SSO / SAML | ✓ | ✗ | ✗ | ✗ | ✗ |
| Configure VectorDB Connection | ✓ | ✗ | ✗ | ✗ | ✗ |
| Manage Jira/Confluence Integration | ✓ | ✓ | ✗ | ✗ | ✗ |
| Configure Workflow Tabs | ✓ | ✓ | ✗ | ✗ | ✗ |
| Trigger AI Generation | ✓ | ✓ | ✓ | ✗ | ✗ |
| Edit Generated Content | ✓ | ✓ | ✓ | ✗ | ✗ |
| Approve / Reject Content | ✓ | ✓ | ✗ | ✓ | ✗ |
| Export to Jira / Confluence | ✓ | ✓ | Limited | ✗ | ✗ |
| Run Quality / OWASP Scans | ✓ | ✓ | ✓ | ✗ | ✗ |
| Add Comments / Ratings | ✓ | ✓ | ✓ | ✓ | ✗ |
| View Finalized Content | ✓ | ✓ | ✓ | ✓ | ✓ |
| View Audit Logs (instance) | ✓ | ✗ | ✗ | ✗ | ✗ |
| View Cost Tracker | ✓ | ✓ | ✗ | ✗ | ✗ |
How Does Role-Based UI Rendering Protect Sensitive Actions?
FlowSquad's frontend performs server-side role hydration on every authenticated session: when a user logs in, their effective permissions set is returned as part of the session token and used to conditionally render UI elements. Buttons for "Generate", "Export to Jira", "Delete Product", and "Manage Users" are not merely disabled for unauthorized users — they are completely absent from the DOM. This prevents accidental clicks, discourages social-engineering attempts ("just click the hidden button"), and reduces information leakage about available actions.
Role-based rendering covers 47 distinct UI elements across the FlowSquad interface — including navigation tabs, action buttons, inline edit controls, admin panel sections, and export menus. Each element is tagged with a required minimum role, and the session hydration layer evaluates each tag before rendering the component tree.
How Does FlowSquad Enforce RBAC at the API Layer?
UI-level hiding is a usability feature, not a security control. All FlowSquad API endpoints enforce declarative RBAC middleware that re-validates permissions on every request, regardless of what the client claims. Each API route is decorated with a required role annotation. The middleware extracts the JWT from the Authorization header, decodes the user's role and product scope, and returns HTTP 403 before the route handler executes if the role is insufficient.
This dual enforcement — UI layer and API layer — means that even a technically sophisticated user who constructs raw API requests cannot bypass permissions. All permission failures are logged as audit events with timestamp, user ID, source IP, attempted action, and the endpoint that rejected the request. Unusual patterns (e.g., repeated 403s from the same user) can trigger alerts in SIEM integrations via FlowSquad's webhook audit log export.
How Do You Assign and Manage Roles in the Setup Wizard?
During the FlowSquad Setup Wizard (Step 7: User Management), the Global Admin provisions the initial user roster by email, assigns roles, and optionally imports users from an SSO/SAML directory. Role assignment is also available post-setup from Admin → Users → Edit User, where the Global Admin can change a user's global role or per-product role assignments at any time. Changes take effect on the user's next request — existing sessions are invalidated within 5 minutes via JWT expiry.
For large organizations syncing from Active Directory or Okta, FlowSquad supports SCIM 2.0 provisioning (roadmap Q2 2026) to automate role assignment based on directory group membership, eliminating manual onboarding for new team members.
Frequently Asked Questions
Can a user have different roles in different products?
Yes. A user can be an Analyst in Product A, a Reviewer in Product B, and have no access to Product C. Product-level role assignments are independent of each other and of the user's global role. The effective permissions for any given request are computed from the union of the user's global role and their product-specific role, with the more permissive role winning within the product scope.
Is there a way to create custom roles beyond the 5 built-in roles?
Custom role definitions are on the FlowSquad roadmap for Q3 2026. In the current version, the 5 built-in roles cover the vast majority of enterprise access control patterns. For edge cases, the Product Admin role with selective feature tab disabling (e.g., disabling the Quality tab for a specific product) can approximate custom role behavior.
How does RBAC interact with MFA enforcement?
MFA (TOTP or hardware key) is enforced at login for all users, regardless of role. Global Admin accounts can be configured to require MFA re-authentication before accessing Admin-level settings (system config, user management) even within an active session. This provides privilege escalation protection equivalent to sudo re-authentication in Unix systems.
Does FlowSquad support SSO group-to-role mapping?
Yes. When SAML 2.0 SSO is configured, FlowSquad can map IdP group attributes to FlowSquad roles. For example, the AD group flowsquad-admins can map to Global Admin, and flowsquad-analysts can map to Analyst. Group-to-role mapping is configured in Admin → SSO Settings → Role Mapping during Setup Wizard Step 6.
What happens to a user's data when their role is downgraded?
Downgrading a role (e.g., from Analyst to Viewer) removes the user's ability to trigger actions but does not delete any content they previously created. Generated Epics, Stories, and analysis results remain accessible in read-only form. If an Analyst is removed from a product entirely, their previously generated content is retained and reassigned to the Product Admin for review.