Roles and access

Two roles, what each can do, and why the read/administer split is enforced in code rather than in the interface.

Flux uses Microsoft Entra ID for authentication. People sign in with the account they already have; Flux never stores a password.

The two roles #

Flux.Reader Flux.Admin
Dashboards and reports Yes Yes
Inventory, changes, opportunities Yes Yes
Exports and evidence packs Yes Yes
Flux Intelligence Yes Yes
Configure integrations — Yes
Start a synchronization — Yes
Set allocation, budgets, unit dimensions — Yes
Review anomalies, set recommendation status — Yes
Read assistant transcripts for quality review — Yes

Most people need Flux.Reader. Reserve Flux.Admin for whoever owns the FinOps practice and the platform configuration behind it.

The split is enforced server-side Reader restrictions are not a matter of hidden buttons. Attempting a configuration or synchronization action without the admin role is rejected by the API, so a reader cannot trigger one by crafting a request.

Assigning access #

Assign the app roles in Entra ID, either directly to people or through groups. Group-based assignment is usually less work to maintain — map an existing FinOps or platform group rather than managing membership twice.

New users see the workspace immediately on first sign-in. There is no per-user setup step and no second account to create.

Signing in #

Flux is reached at your organization’s own address, which your administrator will have shared. Once you are there, authentication is handled by Entra ID with the role assigned to you.

If you do not know your address or cannot get in, whoever holds Flux.Admin can both tell you and grant you access.

What Flux can do in your cloud #

Nothing. Worth stating plainly, because it is the question every security reviewer asks first:

  • Flux reads. It performs no cloud mutation — no resize, no delete, no purchase, no tag edit.
  • It holds no credentials in its codebase and uses a managed workload identity.
  • Recommendations are evidence for a human decision, produced separately from any action taken on them.
  • Flux Intelligence can autonomously decide what to look at, and has no tool available to it that changes anything. See How the assistant is bounded.