Documentation menu
Overview
Getting started
Platform
Partners
Security
Docs / Getting started
Roles
kymeer has six user roles, from Analyst to Platform Admin, checked by the server. What each is for, who can grant which role, and how changes are audited.
kymeer has six user roles: Analyst, Senior Analyst, Tenant Admin, MSSP Admin, Platform Admin and Auditor. Permissions are checked by the server, not by hiding menu items.
What is each role for?
| Role | What it is for |
|---|---|
| Analyst | Day-to-day SOC work: searching events, reading incidents, using dashboards and exporting data |
| Senior Analyst | Analyst work plus updating incidents, building parsers for the tenant, confirming unidentified devices and authoring ingest drop rules |
| Tenant Admin | Administers one client tenant: its users and roles, agents and collectors, and tenant settings |
| MSSP Admin | Administers the MSSP's own client tenants, including creating them and managing their users |
| Platform Admin | Operates the platform itself: MSSPs, platform infrastructure, the shared parser and detection-rule catalogues, and AI provider keys |
| Auditor | Read-only: searches a restricted set of fields, reads incidents and dashboards, and cannot export |
Do higher roles include all lower ones?
No. Roles are not a strict ladder. Platform Admin, for example, is not a superset of MSSP Admin: some operations belong only to one of them.
Platform Admins work on MSSPs and the platform, not inside client tenants. Emergency access to a tenant uses a separate break-glass grant that is tied to a ticket reference and a reason, limited in time and audited.
Who can grant which role?
| Granted by | Can grant |
|---|---|
| Tenant Admin | Analyst, Senior Analyst and Auditor |
| MSSP Admin | Any role except Platform Admin |
| Platform Admin | Any role |
Analysts, Senior Analysts and Auditors cannot grant roles.
How does the service model change what an MSSP can see?
Each client tenant has a service model, chosen at onboarding:
- SOC as a service — the MSSP operates the SOC, and an MSSP Admin can switch into the tenant to provide SOC services.
- Platform as a service — the customer runs its own SOC. The MSSP does not access tenant data and manages only the tenant's global settings, such as lifecycle and limits.
- Proof of concept — a trial tenant that behaves like one of the two models above.
Are role changes audited?
Yes. Assigning or revoking a role writes a record to the tenant's audit log. The log is append-only and hash-chained with SHA-256 per tenant, so a deleted, reordered or altered record breaks the chain.