NeelAI has three roles and no more. Anything finer-grained is a module grant rather than another role, because a role list that grows with every exception stops describing anything.
1The three roles
| Role | Scope | Can grant access? | Typical holder |
|---|---|---|---|
platform_admin | Every tenant on the installation | Yes, anywhere | SoftCore support |
customer_admin | Their own tenant only | Yes, within their tenant | The customer's IT lead |
user | Only what they have been granted | No | Finance and operations staff |
A user with no grants can sign in and sees an empty application. That is deliberate: a new account is harmless until somebody decides what it should reach, rather than useful until somebody remembers to lock it down.
platform_admin is for the people who run the installation, not for senior people at the customer. A managing director who should see everything is a customer_admin, or a user granted every module — not a platform admin, which would also show them other tenants.2Adding someone
Administer → Users → Add. You need their email address, their first and last name, and the role. The names are required rather than optional because answers address people by name, and an account with a blank name produces greetings with a hole in them.
The account is created with no module grants. Set those before telling the person their account exists, so their first sign-in shows them their work rather than an empty shell.
3Changing what someone reaches
Change the grants, not the role. Promoting a credit controller to customer_admin because they need one more dashboard hands them the whole tenant and the ability to grant themselves anything else; adding dashboard.collections hands them the dashboard.
Grant changes take effect on the user's next request. Nobody has to sign out and in again, and a dashboard that has just been revoked stops answering immediately, including on a page the person already had open.
4Removing someone
Deactivate rather than delete. A deactivated account cannot sign in, its grants stop applying at once, and its question history stays attached to it — which is the whole point of keeping a history for when somebody asks, six months later, who ran a particular query.
5Checking it is right
The grants table in Administer → Users is the whole truth about who reaches what. There is no second place where access is decided and no setting elsewhere that quietly overrides it, so reading down the column for one dashboard tells you exactly who can open it.