Roles across the products

The roles in HRS Learn, HRS Triage, HRS Exposure and the partner console side by side, and how to keep admin access small.

Each product has its own short list of roles, because each does a different job. A person can hold a different role in each one: an IT lead might be an admin in HRS Learn and a viewer in HRS Triage.

HRS Learn

Role	Shown as	Can
Employee	Learner or Employee	Their own training, policies, score and certificates. Nothing about anyone else's results.
Organization admin	Admin	Everything in the organization: people, training, simulations, policies, reports, settings and billing.
MSP admin	MSP admin	Their own MSP plus the client organizations it manages, through the partner console.

Two things that aren't roles:

Manager is a reporting line, not a permission. A manager can be told when one of their people repeatedly falls for practice phishing, and gets a coaching guide for that conversation. They don't get admin access.
HRS staff are never members of your organization and never take a seat. Support access to your organization is granted for a limited time, with a reason, and logged.

When you add someone, by hand, by CSV, by SCIM or by single sign-on, they start as an employee unless you choose otherwise. Nobody can change their own role. See Roles and what each one can do.

HRS Triage

Role	Can
Viewer	See cases, verdicts, scores, indicators and the audit trail.
Analyst	Everything a viewer can, plus read reported emails and attachments, export, set verdicts and act on cases and campaigns.
Admin	Everything an analyst can, plus manage analysts, settings and automation, and approve actions.

Triage also has scope: one organization, or every client of an MSP. See Roles, scope and managing analysts.

HRS Exposure

Role	Can
Viewer	Read findings and reports.
Analyst	Everything a viewer can, plus triage findings, run scans and manage domains.
Admin	Everything an analyst can, plus manage users, organization settings and API keys.

People who open Exposure from HRS Learn arrive with a role based on their HRS Learn access.

Partner console team

Role	Can
Admin	Run the partner console and operate inside client organizations.
Operator	Operate inside client organizations.
Read-only	View the partner console without operating inside clients.

MSP team members are added by HRS. See MSP questions.

Keep admin small

Many people who ask for admin want something narrower: their team's completion figures, a report they can read, or someone else to assign training for them. A filtered report or an export usually answers it. Give admin to the few people who need to change settings, people or billing, and review the list each quarter.