Skip to main content

​
Overview

Every user in nOps holds one or more roles, and each role carries two kinds of access:
  • Permissions — which features a role can use (for example, viewing budgets or managing integrations).
  • Data scope — which rows of cost data a role can see (for example, only certain AWS accounts, a specific department, or a subset of your Cost Allocation values).
Permissions and data scope are configured together when you create or edit a role, but they answer different questions. Permissions decide whether someone can open a page or take an action. Data scope decides what they see once they’re there — the same Explorer report, filtered differently for different people.
Data scope is optional. Most organizations don’t need it — every role is Unrestricted by default, meaning it sees the same cost data as anyone else in the organization. Add a scope only when you need to limit what a specific role can see.

​
Get started

1

Open Organization Roles

Go to Settings → Users. Scroll down to the Organization Roles section, below Organization Users.
2

Create or edit a role

Click Add role to create a new one, or click an existing role to edit it. This opens a dialog with three tabs: Details, Permissions, and Data scope.
3

Set the access mode

On the Data scope tab, choose:
  • Unrestricted — the role sees all cost data your organization has access to. This is the default.
  • Restricted — the role only sees rows matching the rules you define below.
4

Add scope rules (Restricted only)

Click Add rule and configure it — see Building a scope rule below. You can add multiple rules to a single role.
5

Preview and save

Use Run preview to see the impact before saving, then save the role.
A Restricted role with no rules denies all cost data — it’s a hard deny, not “everything.” Add at least one rule, or switch back to Unrestricted.

​
Building a scope rule

Each rule narrows a role’s data down to specific values on one dimension:
  • Dimension — any Explorer dimension (account, region, tag, and more), or Cost Allocation, which lets you scope to a specific showback’s allocation values.
  • Operator — Include (the role sees only rows matching these values) or Exclude (the role sees everything except rows matching these values).
  • Values — the specific accounts, tags, or other values to include or exclude.
  • Include rows with no value — when checked, rows where this dimension is empty or unallocated are still visible. Leave this unchecked (the default) if unallocated spend shouldn’t be visible to a scoped role.
You can add several rules to the same role. Within one role, rules narrow together — a role scoped to Account = A and Environment = prod only sees rows matching both.

​
How multiple roles combine

If a user holds more than one role, their access is the union of every role’s scope — adding a role only ever widens what someone can see, never narrows it. If any one of a user’s roles is Unrestricted, that role wins and the user sees everything, regardless of any other role’s restrictions.

​
Previewing impact

Before saving a restricted role, use Run preview on the Data scope tab to see:
  • Scoped total — spend visible to the role over the last 30 days, under your current rules.
  • Unrestricted total — the same window with no restrictions, for comparison.
  • Matching rows — how many rows of cost data the rules currently match.
Check Preview as unrestricted role to see what the total would look like if this role had no restrictions — useful for sanity-checking how much a rule set is actually narrowing.

​
The roles table

The Organization Roles table lists every role available to your organization, including built-in environment roles and any custom roles you’ve created, with columns for:
  • Name and Slug
  • Data scope — a short summary such as “Unrestricted” or a description of the active rules
  • Type — built-in or custom
  • Description
If a role’s data scope no longer matches a role that exists in your identity system (for example, if the role was deleted there directly), you’ll see a banner noting how many scopes are affected. Those scopes are ignored when resolving access — recreate the role to restore it, or leave it to be cleaned up.

​
FAQs

Only organization admins with access to role management can create or edit roles and their data scopes, from Settings → Users.
Nothing changes — the role stays Unrestricted and behaves exactly as roles always have, with access controlled purely by permissions.
Yes. Choose Cost Allocation as the dimension, then select the specific showback whose allocation values you want to include or exclude.
Both. Totals, percentages, and chart values are recalculated under the role’s scope — a scoped user’s dashboard reflects only the spend they’re allowed to see, not the organization’s full total.
If your identity provider manages role assignment, per-user role changes made directly in nOps can be overwritten on the next sync. Manage role assignment through your directory’s group mapping instead.
  • Users — invite team members and manage their roles
  • Organizations — organization-level settings and switching
  • Explorer — the dimensions available for scope rules are the same ones you filter by in Explorer