User Roles and Types

Stairwell has four user roles. A role decides what someone can do; environments decide what data they can do it to. You need both to describe somebody's access.

Role	What it means
Admin	Full privileges. Creates and manages users, service accounts, tokens, environments, and organization settings
User	Standard access. Sees and works with all data, but cannot manage users, service accounts, or tokens
Read Only	Sees everything a User sees, changes nothing
Disabled	No access. The account is retained rather than deleted

Admin is the default role for new users. That is the single most important sentence on this page. Somebody invited without a deliberate choice arrives able to create tokens, change roles, and alter organization settings. On most teams that is not what was intended, so make the role an explicit decision at invite time rather than a correction afterwards.

What can each role actually do?

Admin works at the organization level: creating and managing user accounts, assigning roles, generating and revoking auth tokens, creating and managing environments, and updating organization settings.

User covers the day-to-day work this documentation is mostly about: viewing assets, running searches, writing YARA rules, setting opinions, and working with threat reports. No administrative actions.

Read Only is genuinely read only. Every permission is downgraded. It is the right role for auditors and for stakeholders outside the security team who need visibility without the ability to change a verdict or silence an alert.

Disabled cannot sign in at all. Stairwell keeps the account rather than deleting it, deliberately: audit trails and activity history reference the user, and deleting the account would leave those records pointing at nothing. A disabled account is how you remove access without damaging the record of what that person did.

What about forwarder service accounts?

A special user type, tied to File Forwarder tokens, and its behavior is worth reading twice because two of the three cases are counterintuitive.

Disabling a Forwarder Service Account does not disable its tokens. It prevents the token from registering new assets, and existing ones keep reporting.
Disabling the user who created a Forwarder Service Account has no effect on the token at all.
To actually stop a forwarder token, revoke the token. See Create and Revoke Auth Tokens.

So "we disabled that person's account" is not an answer to "is that forwarder still ingesting". Those are separate actions on separate objects.

How do I change someone's role?

Organization Admins only.

Sign in at app.stairwell.com.
Select the Settings icon in the left menu.
Open the Users tab.
Select the pencil icon next to the user.
Choose Admin, User, Read Only, or Disabled.
Confirm.

Audit the Admin list periodically. Given that Admin is the default, an organization that has been adding people for a year without thinking about it will have more administrators than it meant to, and nothing in the product will point that out.

What should I read next?

Environments, for the other half of an access question.
Create and Revoke Auth Tokens, for non-human access.
SSO and Authentication, for how people sign in.