Roles and whitelist
Tier: Starter, Professional, Enterprise
Passwd allows flexibility in managing access through whitelisting Users and Google Workspace Groups:
-
Whitelist Users: You can add specific users to a whitelist.
-
Whitelist Groups: Assign roles to entire Google Workspace groups, streamlining role management by automatically applying permissions to all group members. Google Workspace admins can define groups here.
Managing Roles in Passwd
Passwd provides four roles to manage user access to credentials:
-
Editor: Users can view, edit, share, and delete credentials. Ideal for admins or managers requiring full access.
-
Viewer: Users can view credentials but cannot edit or share them. Suitable for team members who only need access to login details.
-
Autofill Only: Users can autofill login forms via the browser extension without seeing the actual passwords. Useful for limiting access to credential visibility. Please note that user with this role can still reveal the password once autofilled.
-
Passkey Only: Users can log in with passkey via the browser extension. Users won't be able to reveal the password or save the passkey to their device. The service may allow users to create new passkeys.
Vaults have their own roles (Editor and Viewer). They are separate from the roles above, and a user gets the highest access from any of them.
How access is combined
A user can get access to a record from several places at once. Passwd checks all of them and gives the user the highest access from any of them:
| Source | What the user gets |
|---|---|
| Owner (the person who created the record) | Always Editor. |
| Passwd admin | Editor on every record in the workspace, except records in someone else's Personal vault. With limited admin visibility, only the records shared with the admin. |
| Vault role | Editor or Viewer on every record in the vault. |
| Whitelist user | The role the record was shared with. |
| Whitelist group | The role the record was shared with, for every member of the group. |
For example, Jane is a Viewer of a record because her group was added to it, and an Editor of the vault the record sits in. Jane can edit the record. Removing her from the vault returns her to Viewer.
A few rules worth knowing:
- Autofill only and Passkey only apply only when nothing else gives the user Viewer or Editor access. If someone gets Autofill only from one group and Viewer from another, they can view the record.
- Personal vaults are the exception to everything above. Only the owner can access the records in a Personal vault, even admins.
- Changes to Google Workspace groups are cached for up to 15 minutes. If you add someone to a group, or remove them, expect the change to show up in Passwd within that time.