Understand roles

Last updated: Jul 21, 2026

---

Members on the Fluid Attacks platform have distinct roles with associated permissions. You can view your role within the organization or group you are navigating in the user menu, which is in the upper-right corner of your screen.

This page explains the different roles that are available on the platform, along with the permissions they grant.

Organization-level roles

Organization Manager role

Designed for technical leaders within their organization, this role provides access to all privileges on the platform available to clients, especially enabling them to handle credentials, billing, members, and policy settings, on top of the vulnerability management functions granted to other client roles.

User role (organization level)

Members with a User role at the organization level have permission to be read-only dashboard viewers for the organization. The role lets a stakeholder see the organization's aggregate security posture, compliance standing, credentials list, and groups list (only those they have been invited to, if any). They cannot, for example, add members, change policy or payment settings, or do anything destructive like removing credentials or members. Within groups, they can be granted any of the three roles available for clients: Group Manager, User, or Vulnerability Manager.

Group-level roles

Group Manager role

Designed for technical leaders within their group, this role allows them to perform all actions available to clients in the group on the platform. It is designed for product leaders, granting exclusive capabilities like generating testing certificates, accepting vulnerabilities permanently, approving vulnerability deletion requests by their company, managing group information, managing group members, deactivating and moving Git repositories, adding exclusions, and more (details below).

User role

This is the role most members are given within a group. It is typically assigned to developers responsible for remediating vulnerabilities. Members with this role can access vulnerability information, request reattacks, update treatments, make false positive requests, add and remove tags, and post comments. They can also manage the testing scope by adding Git repositories, IP roots, URL roots, and environment secrets manage Group tokens, upload and delete threat model files, add and download group files, create and remove portfolios, and request event verifications. At the organization level, they can download compliance reports and submit vulnerabilities for temporary or permanent acceptance.

Vulnerability Manager role

Intended for technical leaders within their group, this role grants additional oversight capabilities on top of the User role. Vulnerability Managers can generate reports, view group members, assign fix work to members, and approve or reject treatment acceptance requests. They also have all the group-level permissions of the User role, like managing testing scope, Group tokens, and threat model files, as well as requesting reattacks, updating treatments, and posting comments on vulnerabilities, among those already mentioned. The Vulnerability Manager role at the organization level does not exist.

Permissions