Users, teams & roles - Solya Docs

Access in Solya is governed by roles (bundles of permissions) assigned to users, who can also be grouped into teams.

Users

Invite and manage organization members under Settings → Users. Membership comes from your identity provider (Keycloak); within Solya you assign roles and can remove a user from the organization. Removing a user also revokes any API tokens they created.

Teams

Group users into teams to organize them and manage role assignments at scale.

Roles

Role	Focus
Organization admin	Full access to everything
User manager	Manage users, teams, roles
Data platform admin	Configure data sources, ingestion, sandbox; view analytics
Intelligence layer admin	Configure rules & recommendations; view analytics & signals
Inventory manager	Manage all inventory plans; view analytics & signals
Shop manager	Manage plans for assigned shops
Shop viewer	Read-only analytics for assigned shops
Analyst	Analytics & signals across all shops
Plan approver	Decide plan approval requests

Permissions

Roles grant fine-grained, dot-notation permissions, for example:

users.view, users.remove, teams.manage, roles.assign
org.settings.view, org.settings.edit
dataPlatform.view, dataPlatform.configure, dataPlatform.runSandbox
intelligenceLayer.view, intelligenceLayer.configure
inventoryPlans.view, inventoryPlans.manage, inventoryPlans.approvalsDecide
signals.view, signals.manage, analytics.view, analytics.manage
shops.viewAll vs shops.viewAssigned

Permissions are enforced server-side — every server action and API route checks the required permission after authentication, so the same rules protect the UI and the API.