Roles Reference
Every identity in MASS has one or more roles that control which administrative operations it can perform. Roles are assigned when the identity is created and can be changed at any time; changes take effect immediately.
Roles are managed under Identity & Access → Access Rules → Roles.
Built-in Roles​
Built-in roles cannot be modified or deleted.
| Role | Description |
|---|---|
super_admin | Full system access: manage volumes, groups, identities, policies, roles, and audit logs. The only role that can start a software update or perform a factory reset. |
general_manager | Full management access: manage all resources, roles, and settings. Cannot perform a factory reset or manage storage infrastructure. |
volumegroup_manager | Full storage control scoped to volume groups: manage volumes, volume groups, and storage configuration, and manage access policies within the assigned volume groups. |
volume_manager | Volume-focused operations scoped to a volume group: create and manage volumes within the assigned volume group; read-only on identity and policy information. |
identity_manager | Access control administration: manage identities and access policies, and create and assign roles. |
usergroup_manager | User group administration scoped to specific user groups: manage members and access policies for the assigned user groups. |
viewer | Read-only access: view volumes, groups, identities, policies, roles, and audit information. |
member | General end user scoped to a volume group: read and write access to volumes within the assigned volume group; no administrative permissions. |
The former auditor role has been retired. Existing auditor identities are migrated to
viewer automatically.
Recommendations for Initial Setup​
| Account purpose | Recommended role |
|---|---|
| Break-glass administration, software updates | super_admin (keep at least two) |
| Day-to-day platform administration | general_manager |
| Storage administration for one team's volume groups | volumegroup_manager (scoped) |
| User and access management | identity_manager |
| Monitoring and reporting | viewer |
| Regular users who mount volumes | member (data access via access policies) |
Avoid using super_admin for routine operations. Note that only super_admin can start a
software update or upload an update bundle — the update controls are hidden for every other
role.
Custom Roles​
Navigate to Identity & Access → Access Rules → Roles → + Add Role to define a role with a specific set of permissions. A custom role carries:
- API operations — administrative actions such as managing volumes, identities, policies, roles, and viewing audit logs
- Storage access — direct I/O permissions on volume data (read, write, delete, admin)
- Tenant scope — optionally restrict the role to specific volume groups, volumes, or user groups
Custom roles let you apply least privilege when no built-in role matches. Built-in roles cover most cases — reach for a custom role only when you need a unique permission combination.