Core
Sign-in and roles
Sign-in methods, two-factor authentication, devices, roles and invitations.
Accounts, roles and invitations are shared by all Marsstein products, so Accounting and Compliance link to this page.
Sign-in methods
You can sign in with an email code, a password, Google, Apple or a passkey. Under Settings, Auth, Account you see the list Sign-in methods with the state Linked or Not linked for each, and the method your current session came in by.
In short
Try it
Open Settings, then Auth, then Account.
Under Sign-in methods press Link next to Google or Apple, or add a passkey.
Rename or remove a passkey from its row. The last way to sign in cannot be removed.
Good to know
- Your organisation can turn individual methods off. The row then reads "Turned off by your organization". Administrators set this under Auth, Sessions, Organization.
- Changing passkeys asks you to confirm it is you, with an authenticator code or a fresh sign-in.
- Forgot your password? Use the link on the sign-in page. The reset mail goes only to addresses that have a password account.
Two-factor authentication and recovery codes
Under Settings, Auth, Account, in the group Protection, Two-factor authentication shows Enabled or Not enabled. Set up shows a QR code for your authenticator app, a setup key and a link, then asks for the 6-digit code.
In short
Try it
Press Set up and scan the QR code.
Enter the 6-digit code and copy the Recovery codes. Confirm with "I have saved them".
Good to know
- At sign-in, "Lost your authenticator? Use a recovery code" opens the recovery form.
- Renew creates new recovery codes and the old ones stop working.
- To remove two-factor, enter a current code from the app.
Devices and sessions
Auth, Sessions lists Your devices with the method, sign-in time, last activity, expiry and whether a second factor was confirmed. This device is marked. Activity and alerts and the organisation's allowed methods are on the same tab.
In short
Good to know
- If only this device is signed in, the list says there is nothing else to do.
Roles
Every member holds one role. The names in the app are Owner, Admin, Editor, Lawyer and Viewer.
| Role | May do |
|---|---|
| Owner | Everything an Admin may, plus the owner-only actions: delete the organisation, manage the organisation and team settings, export the audit trail |
| Admin | Manage teams, invite and remove members, edit all documents, approve and reject, manage connectors, routines, memory and settings, read the audit log |
| Editor | Create and edit documents, tasks, risks and routines, submit documents for approval, use the agent and the computer, read connectors and settings |
| Lawyer | Read and edit documents, approve and reject them, resolve comments, update tasks and routines, read the audit log |
| Viewer | Read documents, files, tasks, risks, templates, memory, connectors and routines, and read agent sessions |
In short
Try it
Open Auth, then Roles & Rights and read the matrix of rights per resource.
Press Create Custom Role, name it and tick the rights it should hold.
Good to know
- Permissions preview shows what a chosen member may do, including which agent tools are available for the role.
- A revoked right beats a granted one. A custom role can never hold the owner-only rights.
- Deleting a custom role means its holders must be given another role.
Invitations and invite links
Under Auth, Members & Invites you invite people by email or with a link. In the dialog Invite member you enter one or more email addresses, choose the Role and the Access scope: Organization-wide access or Team-specific access with the selected teams. Invitations are listed with their expiry and can be copied or revoked.
In short
Try it
Press Invite, enter an email address and pick the role and scope.
Press Send invitation. Addresses that are already members or already invited are marked and must be fixed first.
For a link, press Create invite link and send it. Revoke ends it.
Good to know
- Nobody can be invited as Owner. Links grant only the lower roles the organisation allows (Viewer and Editor by default).
- A person who asked to join shows up as an access request ("asked to join"). Approve or Deny it from the member list.
- Administrators can set a new sign-in address for a member who lost access (Sign-in recovery). The account moves when that person signs in with the new address.