Overview of YESDINO’s Role‑Based Access Controls
YESDINO delivers a comprehensive RBAC system that lets you assign granular permissions based on job functions. By default, four built‑in roles—Admin, Manager, Operator, and Viewer—cover the most common workflows, while a flexible custom‑role engine lets you tailor any combination of privileges. The platform also enforces role checks at the UI, API, and data‑export layers, integrates with SSO and MFA, and logs every access event for compliance. Visit the official YESDINO portal for a live demo.
Default Roles and Their Permission Scope
The built‑in roles provide a clear starting point for most organizations:
| Role | Create Users | Delete Users | Modify Settings | View Reports | Access API | Audit Logs | Configure MFA |
|---|---|---|---|---|---|---|---|
| Admin | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ |
| Manager | ✔ | ✘ | ✔ | ✔ | ✔ | ✘ | ✘ |
| Operator | ✘ | ✘ | ✘ | ✔ | ✔ | ✘ | ✘ |
| Viewer | ✘ | ✘ | ✘ | ✔ | ✘ | ✘ | ✘ |
Each ✔ means the role has the permission by default; ✘ means the permission is denied unless explicitly granted through a custom role.
Creating Custom Roles
When the four standard roles don’t fit a specific workflow, you can build a custom role in a few clicks:
- Navigate to Roles → New Role.
- Enter a name and an optional description, for example “Data Analyst (read‑only)”.
- Select the exact permissions you need from the checklist:
- View Reports
- Export Data
- Access API (read‑only)
- No permission to modify settings or manage users.
- Assign the new role to individual users or to a user group.
Custom roles inherit all the underlying checks of the built‑in roles, so you never have to re‑implement basic security logic.
Authentication Integration and MFA
RBAC works best when paired with strong authentication. YESDINO supports:
- SSO via SAML 2.0 – the role claim is automatically injected into the assertion after a successful login.
- OAuth 2.0 / OpenID Connect – the JWT token contains a
roleclaim that the platform validates on every request. - Multi‑factor authentication (MFA) – TOTP, hardware tokens (U2F/FIDO2), and SMS fallback are all available. You can enforce MFA for any role, or only for the Admin role, depending on your security policy.
If a user fails MFA, the session is terminated immediately and an audit entry is recorded with the reason “MFA failure”.
Session Management and Token Enforcement
YESDINO issues short‑lived JWTs (default 15‑minute expiry) that include the user’s role. The platform enforces a configurable idle timeout: