Access Control

StifleR's access control system has three layers that work together: licensing, features, and RBAC permissions.

License key  ──▶  Feature sets unlocked  ──▶  Admin enables/disables  ──▶  RBAC permissions apply  

Your license determines which feature sets are available. Features can be globally enabled or disabled by an administrator on the Features page. Within each enabled feature set, RBAC subjects (for example BootImage, TaskSequence, ThrottlingPolicy) define what a user can act on, and verbs (Read, Write, Delete) define how. If a feature is unlicensed or disabled, all RBAC permissions under its subjects are denied — regardless of what roles grant.

Access hierarchy

Level	Description	Configuration
Global Admin	Full access to everything. Bypasses all permission checks.	StifleR Service Config Editor — AdministratorGroup or OIDC group mapping
Global Read	Read-only access to all feature sets, dashboard-wide.	StifleR Service Config Editor — ReadGroup or OIDC group mapping
Role-based (RBAC)	Fine-grained permissions granted through roles. A user can have multiple roles; effective permissions are the union of all roles.	Roles and claim rules — see Roles and Permissions
No access	No roles, not global admin or read. Blocked at login.	—

For Windows authentication, Global Admin and Global Read are configured in the StifleR Service Config Editor via the AdministratorGroup and ReadGroup settings. For OIDC authentication, they are mapped via group claims in your identity provider (see Entra ID Integration or Ping Identity Integration). Role-based permissions are managed within the StifleR dashboard under System > Roles.

Licensed feature sets

Your license key(s) determines which feature sets are available. Administration, Devices, and Networks are always available. All other feature sets require a license key and can be enabled or disabled by an administrator.

If a feature set is missing from the permissions matrix or from the dashboard menu, it is either unlicensed or has been disabled under System > Features. See Licensing and Feature Management for how to apply license keys and manage feature toggles.

Feature sets and subjects

Each feature set contains subjects. A permission record grants a user access to one or more subjects within a feature set, for specified verbs (Read, Write, Delete).

Feature set	Subjects
Administration	License, Feature, User, Rule, Role, Policy, InfrastructureService, ServerHealth, NetworkGroupTemplate
Devices	Device, Elevation, Srum
Networks	Area, Location, NetworkGroup, Network
BandwidthManagement	ThrottlingPolicy, BranchCacheSettings, DeliveryOptimizationSettings, Traffic
CacheManagement	Usage
OsdDeployments	Osd, Autopilot, Generic
DeployR	StepDefinition, TaskSequence, BootImage, ApplicationContent, OsContent, DriverPackContent, OtherContent
CacheR	Packages, DistributionPoints, TrackedContent
RemoteR	FileExplorer, FileContent, RegistryViewer, WmiViewer, EventLogs, PerformanceCounters, ResourceMonitor, TaskManager, DeviceInformation, RemoteAssistance, Rdp, RemoteCli, TsData, Intune, TunnelRdp, ReadLog
MOM	(no subjects defined yet)

Note: This page describes dashboard user access control. For client agent access control (restricting which StifleR Client agents can connect to the server), see StifleR Client Access Control Options.