Glossary · Security & access
RBAC (role-based access control)
Also called: role-based permissions, user roles
Role-based access control (RBAC) is a way of managing permissions in which access rights are attached to roles (such as Admin, Editor or Viewer) and people get rights by being assigned a role, rather than permission by permission.
Without roles, every new person means deciding a dozen permissions one by one, and nobody can say who can do what. With RBAC, you decide once what an "editor" may do, and assigning the role is the whole decision.
Roles that work for automation
The useful split in automation tools isn't just admin vs user. It's who can change logic, who can run it, and who can approve its output:
- builders who edit workflows,
- operators who run them but can't change them,
- reviewers who approve or reject items without touching anything else,
- viewers who can see runs for support or auditing,
- and a small number of admins for members, credentials and billing.
Design rules
- Separate building from approving. The person who built the invoice workflow shouldn't be the only approver of the invoices it routes.
- Give clients and contractors the narrowest role that does the job, in their own workspace.
- Review role assignments when people change jobs, not just when they leave.
RBAC pairs with an audit log: roles say who can act; the log shows who did.
In Fluxo Flow
Each workspace has seven roles: Owner, Admin, Operations Manager, Automation Editor, Automation Operator, Support Agent and Viewer. Support Agents get read-only access to runs plus deciding reviews in the Review Queue, which is how agencies let a client approve AI output without editing workflows. Two-factor authentication is available for every account.
Read next
Related terms
- Audit logAn audit log is a chronological, tamper-resistant record of who did what in a system and when, kept so that changes, approvals and access can be traced afterwards.
- Multi-tenant workspace isolationMulti-tenant workspace isolation means many customers (tenants) share one software system while each workspace's data, credentials and activity are kept strictly separate, so no tenant can see or affect another's.
- SSO and SAMLSingle sign-on (SSO) lets people use one company identity to sign in to many applications, and SAML (Security Assertion Markup Language) is a widely used standard that carries that sign-in from the identity provider to each app.
- Retrieval-augmented generation (RAG)Retrieval-augmented generation (RAG) is a technique in which relevant information is looked up from your own data at request time and added to the prompt, so the model answers from those facts rather than from memory alone.
- Rate limitA rate limit is a cap an API puts on how many requests a client may make in a time window; requests over the limit are refused, usually with HTTP status 429 Too Many Requests.