Users, groups, and grants
Access in StackTakt flows through groups. A group holds role grants at a scope; people inherit the union of their groups’ grants. A person’s effective access to a tenant is the strongest their groups give them, and privileges accumulate: a tenant-wide viewer grant plus an operator grant on one AWS account yields operator on that account and viewer everywhere else.
The five roles
Section titled “The five roles”| Role | What it allows | Grantable at |
|---|---|---|
| Organization Admin | Full control of the organization, including users, groups, and permissions. | Organization |
| Tenant Admin | Run, approve, and accept risk within scope, and manage the people and groups of the tenants in scope. Cannot manage the organization. | Organization, tenant |
| Operator | Read and write, and request deployments. Cannot approve. | Organization, tenant, AWS account |
| Requester | Read, and request deployments for an approver to act on. | Organization, tenant, AWS account |
| Read Only | Read-only access to inventory, deployments, compliance, and audit. | Organization, tenant, AWS account |
Why requesting and approving are separate roles is covered in Approvals and roles.
The three scopes
Section titled “The three scopes”- Organization: covers every tenant, present and future.
- Tenant: covers one tenant.
- AWS account: covers one account inside a tenant. Account-scoped users see the tenant container read-only and full detail only for their accounts.
Two Identity screens
Section titled “Two Identity screens”Organization → Identity (Organization Admins) manages accounts, organization groups, and grants across every tenant. Deactivating a user revokes sign-in and sessions but keeps the account resolvable in the audit trail; nothing is deleted.
Tenant → Identity (Tenant Admins) manages that tenant’s people and groups: add a person by email (an existing account joins the groups you pick; a new address creates one), move people between the tenant’s groups, and grant roles up to Tenant Admin. A Tenant Admin cannot deactivate accounts, touch organization groups, or grant Organization Admin.
Guardrails
Section titled “Guardrails”- Organization Admins is a built-in group that cannot be renamed or deleted, and the platform refuses any change that would leave the organization without an admin.
- Every identity change (user created, group changed, grant added or removed) writes its audit event in the same transaction.
- Tenant isolation reads as not-found: another tenant’s resources are not yours to learn exist.