Roles & Permissions
View and assign platform and app roles in the Admin Panel. Use the permission matrix and Assign Roles table to control what each user can do in Well Management, RodSim, and Calculators.
PetroBench uses two role layers: platform roles set hierarchy scope, and app roles set permissions inside each installed application. The Security section in the Admin Panel is where you review and assign both.
For the full access model, hierarchy rules, and data scoping behavior, see the RBAC reference.
Platform roles vs app roles
| Layer | Roles | Controls |
|---|---|---|
| Platform | HQ Admin, Division Admin, Region Admin, Key User | Which divisions, regions, and admin pages a user can access |
| App | Admin, Engineer, Advisor, Guest | What actions a user can take inside each app |
When you assign a platform role, PetroBench applies a default app role. You can override app roles per user and per application without changing their platform scope.
Automatic role sync only upgrades app roles to match a higher platform role. It never downgrades a manually elevated app role.
Role & Permissions matrix
Open Admin Panel > Security > Role & Permissions to view the permission matrix.
The page shows one tab per installed app (for example, Well Management, RodSim, Calculators). Each tab lists capabilities down the left and the four app roles across the top:
| App role | Summary |
|---|---|
| Admin | Full control, including archive and restore |
| Engineer | Create, edit, delete, import, and run simulations |
| Advisor | Edit existing data; cannot create or delete wells or import |
| Guest | Read-only access to view data and results; uses a free guest seat, not a paid seat |
Use the matrix when deciding which app role to assign. It reflects the current permission set for your organization's installed apps.
Guest role
Guest is the read-only app role for people who need visibility inside your organization without doing design work. Guests are still normal internal users (they sign in with your org, get a platform role and region scope)-they are not anonymous public links.
Seats
Assigning Guest for an app does not consume a paid license seat for that app. It uses the separate guest seat pool on your subscription. Admin, Engineer, and Advisor each consume a paid seat. Details: Billing & Licenses.
What Guests can see and do
Within their platform scope (division / region), Guests can typically:
- View wells and well data
- View and compare simulations, charts, and results
- Open calculators and download simulation reports
- View tags and custom equipment (not manage them)
They cannot create, edit, delete, import, or archive wells; they cannot run or change simulations; they cannot manage users, roles, or tags.
Good fits for Guest
| Example | Why Guest works |
|---|---|
| Operations manager who reviews results | Needs charts and reports, not design tools |
| Finance or HSE stakeholder | Occasional visibility into wells in their region |
| New hire shadowing before full Engineer seat | Read-only onboarding without burning a paid seat |
| Shared “viewer” account for a leadership dashboard | Same org login, no edit risk |
Use Advisor instead when someone must edit existing well data. Use Engineer when they create wells or run simulations.
Assign Roles
Open Admin Panel > Security > Assign Roles to set app roles for each user across applications.
The table lists users in your scope. Each installed app has its own role column.
Assign or change app roles
- Go to Admin Panel > Security > Assign Roles
- Find the user in the table (use search if the list is long)
- Select an app role from the dropdown for each app column
- Click Save
Assign Roles supports Undo and Redo while you are editing. Save only when all changes look correct.
Example assignments
| User type | Platform role | Typical app roles |
|---|---|---|
| Organization admin | HQ Admin | Admin in all apps |
| Field engineer | Key User | Engineer in Well Management and RodSim |
| External consultant | Key User | Advisor or Guest in affected apps |
| Manager (view only) | Key User | Guest in all apps |
Default platform-to-app mapping
| Platform role | Default app role |
|---|---|
| HQ Admin | Admin |
| Division Admin | Admin |
| Region Admin | Admin |
| Key User | Engineer |
Override defaults on Assign Roles when a user needs tighter or broader app access than their platform role implies.
Who can manage roles
| Action | HQ Admin | Division Admin | Region Admin |
|---|---|---|---|
| View Role & Permissions | |||
| Edit Assign Roles (org scope) | Division users only | Region users only | |
| Change platform role on user | Division scope | Region scope |
Key User accounts cannot open role management pages. Ask an administrator to change roles on their behalf.
Relationship to user records
Platform role and region assignment are set on the Users page. App role overrides are set on Assign Roles. Both layers apply together: a user must have platform scope and app permission to perform an action.
Next steps
- Invite users and set platform roles: Users
- Review administrative activity: Audit Logs
- Full scoping and API behavior: RBAC reference