> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/reference/roles-and-access.md).

# Roles and Access

CORTEX checks who you are each time you read or change a record. Your sign-in is only the first check. Your organisation, current access grant, selected workspace, workspace membership, handling access, enabled features, and the record's rules also matter.

A menu item appears only when CORTEX can offer it in your current context. A visible menu item does not promise that every record or action will be available. The page checks again when you open or save it.

## The checks in plain language

| Check                              | What it means for you                                                                                                        |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| Your account                       | You must sign in with your own enabled account. An administrator account does not automatically see intelligence content.    |
| Your organisation                  | A workspace and its records belong to one organisation. Another organisation's account cannot enter it.                      |
| Your access grant                  | The grant names the actions your account may do. It has a start and end time and may be disabled.                            |
| Your workspace membership          | You need active membership of the selected workspace. Its Reader, Analyst, or Manager role limits the actions in your grant. |
| Handling                           | Your access must cover the full marking, including any compartment and caveat.                                               |
| Workspace features and node policy | A feature must be enabled in the workspace and supported on the node. A feature setting does not give you a permission.      |
| Record rules                       | A source, analysis, product, or release can have a separate state, reviewer, recipient, or exact-version rule.               |

**Choose workspace** shows workspaces you may enter. Read the purpose and handling before you select **Open workspace**. If you later lose access, a page may stop showing its content or actions. Ask the relevant Manager or administrator to review the exact missing condition. Do not use a different account to get around it.

## Workspace roles

These are workspace roles. They limit a person's current global access grant.

| Workspace role | What the role can allow when the grant also allows it                                                                                                                    |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Reader**     | Read recognised records in that workspace.                                                                                                                               |
| **Analyst**    | Read and do authorised work, including relevant internal export or generation. This role does not itself permit release approval or access administration.               |
| **Manager**    | Manage workspace details and membership, and perform other recognised workspace work within the person's grant. Manager status does not add a missing global permission. |

A person also needs the right handling access. The organisation administrator or a platform administrator cannot enter a protected workspace merely because they manage accounts.

A current **Mission lead** or **Operations lead** appointment is another decision. It supports the relevant leadership view only with ordinary workspace, permission, and handling access. Manager membership alone is not a lead appointment.

## People in a Demo exercise

The original Demo organisation has sixteen separate accounts. The account names describe an exercise duty. They do not grant legal or operational authority. The operator gives each participant their own credential through an approved channel.

| Exercise duty                               | Demo account prefix                                     | Typical part of the exercise                                  |
| ------------------------------------------- | ------------------------------------------------------- | ------------------------------------------------------------- |
| Organisation owner                          | owner                                                   | Manage the Demo organisation, workspaces, and bounded access. |
| Requirement owner                           | requirement-coordinator                                 | Set the question and review the result.                       |
| Collection planner                          | collection-planner                                      | Prepare collection plans and tasking.                         |
| Source authoriser                           | source-authoriser                                       | Make a separate source-authority decision.                    |
| Assigned collector                          | assigned-collector                                      | Carry out assigned collection tasks.                          |
| Material processor and reviewer             | material-processor, material-reviewer                   | Prepare material and make independent processing checks.      |
| Analytical author and reviewer              | analytical-author, analytical-reviewer                  | Write an assessment and review it independently.              |
| Release reviewer, approver, and distributor | release-reviewer, release-approver, release-distributor | Check, approve, and distribute the exact release.             |
| Recipient                                   | recipient                                               | Acknowledge the package and give feedback.                    |
| Security reporter and manager               | security-reporter, security-manager                     | Report and manage a security case.                            |
| Access administrator                        | access-administrator                                    | Manage bounded access within their own grant.                 |

The named accounts make separation of duties visible. The person who wrote content cannot assume that they can independently approve it. The original Demo owner can manage the tenant. The owner still cannot bypass a separate source, analysis, or release decision.

## If an action is unavailable

{% stepper %}
{% step %}

### Confirm the intended account

Confirm that you signed in with the intended account.
{% endstep %}

{% step %}

### Confirm the selected workspace

Open **Choose workspace** and confirm the selected workspace.
{% endstep %}

{% step %}

### Check handling

Read the handling shown for the workspace and record.
{% endstep %}

{% step %}

### Check workspace features

Open **Workspace settings** if you can. Check whether the relevant feature is selected.
{% endstep %}

{% step %}

### Check workspace membership

Ask the workspace Manager to check membership and its expiry.
{% endstep %}

{% step %}

### Check the access grant

Ask an access administrator to check the current grant and its expiry.
{% endstep %}

{% step %}

### Review the page message

If the action still fails, read the page message. The record may need a different state, a current source decision, an independent reviewer, or a new revision.
{% endstep %}
{% endstepper %}

For node or processing failures, ask the node operator. For authority or disclosure questions, ask the organisation's authorised adviser. The **Help & user guide** in **Help & node** can explain the task before you ask for a change.

Do not record a missing menu item as “no records.” CORTEX can hide a destination or a record when access is unavailable. A page count includes only what that account can see. Use the [researcher guide](file:///7397340/research/researcher-guide.md) to record the account duty, workspace, exact message, and expected action when you study an access problem.