Hi, everyone. I have a question. I created a regular user account, but when I log in with that account, I can see all the groups and all the users in the system—which isn’t supposed to happen. Can you help me?
Hello @hwms83,
What you describe is the expected behavior, we do not restrict the visibility of the Manage Users & Groups workspace by default, however, as an administrator, it’s possible to iterate on this workflow. To do so, navigate to Organisation Settings > Role-Based Access Control > Users > Can see users workspace
There, you can choose for the users role between:
- “Allow” which is the default behavior, what you are seeing right now
- “Deny”, which will restrict the access to Manage Users & Groups workspace for all your users
- “Allow group manager”, which is definitely I would recommend, this will restrict the access for regular users but still gives the possibility for group manager (with users role) to access that page. It’s important for them especially to monitor their groups (add new members, update membership, remove membership etc)
I hope that clarifies! Don’t hesitate if you need further details on that.
Thanks, that was very helpful. Now I have another question: how do I set up a full administrator user, a technology user who can create and change passwords for users and specific groups, and a standard user who can only access their own group?
Glad it helped! 
Just to give you some context on the roles: passbolt has two built-in roles, admin and user, there is no “super admin” above admin. Also, worth mentioning that since v5.8, you can also create custom roles in Organisation Settings > Role-Based Access Control to delegate specific administrative capabilities to non-admin users.
One important thing to understand before mapping your three profiles: passbolt is using end-to-end encryption, so roles never grant access to secrets. An administrator manages the instance (users, groups, organisation settings) but cannot see any password that wasn’t explicitly shared with them. Access to a secret only exists if it has been encrypted for your key, i.e. shared with you.
With that in mind:
-
Administrator: that’s the built-in admin role. They manage users, groups and organisation settings (but as explained above ^, no automatic access to passwords.)
-
Technology user: two aspects here.
- Creating and managing passwords for users and specific groups: Well, any user can do this. They create the resources (which makes them owner), then share them with the relevant users or groups with the permission level you want (read, update or owner). Being a member of a group is not required to share a resource with it, sharing encrypts the secret for each member’s key, it only requires the owner permission on the resource.
- Managing who belongs to those groups: For this, make them group manager of the specific groups. Group managers are necessarily members of the group: due to the encryption model, adding someone to a group requires decrypting the group’s secrets and re-encrypting them for the newcomer, so only someone who already has access can do it. No role can bypass this, (not even admin btw) this is a property of end-to-end encryption, not an arbitrary limitation.
-
Regular user: that’s the default user role. A user can only decrypt what has been shared with them, directly or through their groups. Combine it with the RBAC setting from my previous message if you also want to hide the Users & Groups workspace from them.
I hope that clarifies! 
Thank you for your reply, and I apologize for the delay. Could you please send me a screenshot showing how to make these changes for the Admin user and the IT user?
Hello,
No worries about the delay there. Regarding the custom roles, you can create them in Organisation Settings > Role-Based Access Control and use the “Add role” button as shown below:
To attribute a role after that, you can navigate to the Manage Users & Groups workspace, edit a user, apply the desired role (admin, user, custom(s)):
I hope that will help