Roles and views

One warehouse of findings, presented differently to the people who make different decisions with it. Every view reads the same underlying data, so a number on an executive chart drills through to exactly the findings an engineer sees.

AppSec Lead

The operating role, and the only one that can change anything. Full findings access, uploads and integrations, the dedup and Jira confirmation queues, scoring weights, gate policy, target tiers, economic inputs, ingest tokens, user administration and the audit log.

Risk decisions on findings are restricted to this role, matching the database policy that has always governed who may change a finding. This is enforced in two places: the application checks the role, and the database refuses the write independently.

AppSec Engineer

Full visibility across the tenant's findings, without the ability to change policy, settings or finding status. Suited to analysts who triage and investigate but do not own the decisions.

Executives: CISO and CTO

Tenant-wide read access and the trajectory view, which answers four questions a board asks:

• Are we getting faster? Time to remediate by severity, backlog ageing, and quarterly fix rate against newly opened findings.
• Where is the exposure? Critical findings in production, and exposure by business-context tier.
• Is the policy real? The override rate, and whether each exception has a named owner, a written reason and an expiry date. This is the question no dashboard can answer without the enforcement decision and the exception trail in the same system.
• What does the backlog cost? Engineer-days and sprints of capacity, plus money where the rates have been supplied.

Every headline number links through to the findings behind it. Board summaries export cleanly.

Developers and dev leads

A focused view of the work routed to their team, in priority order, each finding carrying its evidence and a suggested fix. No dashboard archaeology required to find out what to do next.

Management roles

Engineering directors and managers, product managers and product owners have read access suited to planning, including effort estimates and ownership, without administrative control.

Guests

Time-boxed accounts for auditors and consultants, scoped to specific organisations. They expire automatically and are deactivated by the pipeline when they lapse, so a forgotten auditor account does not stay live.

A note on least privilege

Roles are not only a user interface concern. Every restriction described here is enforced in the database as well, so a bug in the application cannot grant access the role does not have.