Users and roles

A tenant can have multiple users, and each is given one or more roles that determine what they can see and do. The role system follows the principle of least privilege: each person has only the permissions their role needs, no more and no less. This protects your automations, credentials and data.

Roles disponibles

Rol	for whom	What can you do
Tenant Owner	The person responsible for the account	Full access to the tenant: manage billing, security and subscription, in addition to everything operational
Tenant Admin	Operation administrators	Operational administration: users, environments, processes, credentials and auditing. Does not access billing
Developer	Who builds the automations	Designs, publishes and maintains processes; manage your credentials and triggers
Operator	Who operates the day to day	Executes and monitors processes in production. Does not modify code or configuration
Auditor	Cumplimiento / control interno	Read only on all tenant resources, plus access to audit logs
Viewer	Observadores	Read only about operational resources (environments, processes, executions)

Permisos acumulativos

A user can have more than one role; In that case, its permissions are the sum of those of each role. Assign the narrowest role that allows the person to do their job.

Owner or Admin?

The key difference is billing and subscription: only the Tenant Owner manages them. For everything else (users, environments, processes, credentials), Tenant Admin has the same scope. It is advisable to have a single Owner (or very few) and share the operation with Admins.

Lectura: Viewer vs Auditor

Both are read-only, but the Auditor also sees the audit logs (who did what and when) and covers all resources; The Viewer is limited to the operational. Use Auditor for compliance and Viewer for someone who just needs to “watch”.

Invite a user

1. Go to Settings → Users.
2. Click Invite User.
3. Enter email and select role.
4. The user receives an email with an activation link to set their password.

Change a user’s role

Only Tenant Owner and Tenant Admin can change roles. Go to Settings → Users, open the user and select the new role.

Delete a user

When you delete a user, their access is immediately revoked. Your history and the executions you have launched are preserved, so as not to lose traceability.

Good practices

• Least privilege: start with the most limited role and expand only if necessary.
• Few Owners: the Owner controls billing and security; limits how many people have it.
• Developers design, Operators execute: separating who publishes from who operates reduces errors in production.
• Periodically review the list of users and remove accesses that are no longer used.

Zoan Automation Admin

There is also an internal role, Zoan Automation Admin, reserved for Zoan Automation support staff for assistance tasks. Not assignable by tenants and does not appear in your role list.

Next steps

• Environments — separate production from testing.
• Credential Management — protect the secrets that users manage.