Users & roles
Accounts, roles, the audit log, and how SSO/MFA fit in.
First run
The first time you open the origin, the setup screen creates the initial admin account. Sign-in after that is a local account with a session cookie.
Roles
| Viewer | Reviewer | Admin | |
|---|---|---|---|
| Read the catalogue | ✓ | ✓ | ✓ |
| Create & edit packages | ✓ | ✓ | |
| Approve versions | ✓ | ✓ | |
| Manage sites | ✓ | ✓ | |
| Manage users | ✓ | ||
| Manage edge nodes | ✓ | ||
| Manage the license | ✓ |
Roles are enforced on the server, not just reflected in the UI — a viewer's session can't perform a reviewer action even by calling the API directly.
Managing users
Admin → Users: create an account, change its role, or remove it.
Audit log
Every approval and administrative action is recorded in an append-only audit log — who did what, and when. Typical entries: a version approved or reset to upstream, a site token created or revoked, a node enrolled or revoked, a user's role changed, a license token replaced. Any authenticated user can read it; changing what's audited is not configurable.
SSO and MFA
The application ships with local accounts.
Enterprise
Single sign-on (OIDC/SAML) and multi-factor authentication (TOTP) are provided by licensed plugins, which the application loads once your license carries the matching entitlement. See Editions & licensing.