Team & roles — multi-user access with per-client scope
Klaxel is multi-user with role-based access control. Every person gets one of four roles — Owner, Admin, Technician, or Viewer — that decides what they can do, and Technicians and Viewers can be scoped to specific client groups so they only ever see the clients you assign them. You invite teammates by email, choose their role and scope, and change or remove them later. One deliberate rule underpins it: only the Owner can manage Admins.
A role is a fixed set of capabilities, not a rank you can climb around. Owner is the account's top authority — full control of every domain, client, setting, the team, billing, and ownership itself. Admin runs the day-to-day: they manage the team, configure the product (domains, groups, routes, integrations, branding), and see everything on the account — but they cannot touch billing, and they cannot manage other Admins or the Owner. Technician and Viewer are the view-only roles, and they are the two roles you can scope to specific clients.
Scoping is what makes Klaxel safe to open up to a wider team. Owner and Admin always act account-wide — they see every domain, including any that aren't in a client group. A Technician or Viewer, by contrast, sees only the client groups you assign them: their dashboard, alerts, reports, and everything else is filtered to those clients and nothing else. This is fail-closed by design — a scoped member you haven't assigned any groups to yet sees nothing at all, never the whole account by accident. Today Technician and Viewer are both read-only within their scope; Technician is the role reserved for hands-on operational abilities as they roll out.
Invite a teammate
- Open Dashboard → Team (Owner and Admin only).
- Enter the teammate's email address and choose their role. Only the Owner sees Admin as an option; an Admin can invite Technicians and Viewers.
- For a Technician or Viewer, pick the client group or groups they should be able to see — this scope is required for those roles, so they land with the right, limited view from their first sign-in.
- Send the invite. Klaxel emails them an accept link (and shows you a copy-link fallback in case the email doesn't reach them). The link is single-use and expires.
- They click the link, set up their mandatory two-factor, and they're in — with exactly the role and client scope you chose.
Only the Owner can manage Admins — this is a deliberate security decision. An Admin can invite, re-role, re-scope, and remove Technicians and Viewers, but can never create another Admin, promote someone to Admin, or demote or remove a peer Admin or the Owner. That ceiling means an Admin can't quietly reduce the oversight on themselves; changing who the Admins are is always the Owner's call.
The Owner is unique and protected. There is exactly one Owner per account, and the Owner can't be demoted or removed while they hold the role — you move ownership with Transfer ownership instead, which only the sitting Owner can do. Transferring makes the chosen member the new Owner and steps the old Owner down to Admin, in one atomic move, so the account is never left without an Owner.
Re-scoping is instant and safe. Change a Technician's or Viewer's assigned client groups on the Team page and their view updates on their next request — add a client when they take it on, remove one when they hand it off. Owners and Admins carry no scope because they already see the whole account.
Frequently asked questions
What are the four roles and what can each do?
Owner — full control of everything, including billing and ownership. Admin — manage the team (Technicians and Viewers), configure the product, and view the whole account, but not billing and not other Admins. Technician and Viewer — view only, and both can be scoped to specific client groups so they see only the clients you assign. Owner and Admin always act account-wide.
Can an Admin manage other Admins?
No — that's reserved for the Owner by design. An Admin can invite, re-role, re-scope, and remove Technicians and Viewers, but cannot create or promote an Admin, or demote or remove another Admin or the Owner. Only the Owner manages Admins, so an Admin can't reduce the checks on themselves.
How does per-client scoping work?
Technicians and Viewers are limited to the client groups you assign them — their dashboard, alerts, and reports show only those clients. It's fail-closed: a scoped member with no groups assigned sees nothing, never the whole account. Owners and Admins are account-wide and see every domain, including ungrouped ones.
How do I change who owns the account?
Use Transfer ownership on the Team page — only the current Owner can. It makes the member you choose the new Owner and steps you down to Admin in a single move. Ownership is never handed out through an ordinary role change or invite; transfer is the only path, which keeps the one-Owner-per-account rule intact.
What happens when I invite someone?
They get an emailed accept link (with a copy-link fallback shown to you). Clicking it joins them to your account at the role and client scope you chose, and — because two-factor is mandatory — walks them through setting up their authenticator before they reach the dashboard. Pending invites can be revoked any time before they're accepted.