Roles & access (RBAC)

AfriPhish lets IT Admins manage admin access themselves, with guardrails that make it impossible to accidentally lock your organisation out.

The role catalogue

Four org-assignable roles, in descending privilege:

IT Admin — full administrative access.
Campaign Manager — run simulations and training; cannot manage users, settings, or integrations.
Viewer — read-only dashboards and reports.
Employee — receives simulations and training; no admin console.

Super Admin is the vendor console and is never assignable inside an organisation.

Go to Settings → Access & Roles. You can:

Grant admin access — invite a new person with an admin role, or promote an existing employee.
Change a role inline from the administrators table.
Revoke access — deactivate an admin.

The platform enforces these rules on the server (the UI mirrors them):

Privilege ceiling — you can only grant a role at or below your own level. Granting above your level is rejected (403).
No self-escalation — you cannot change your own role (400).
Anti-lockout — the last active IT Admin can't be demoted or deactivated (400). An organisation can never be left without an admin.

These guardrails apply everywhere access is granted — manual invites, role changes, and the default role used by SSO/SCIM auto-provisioning.