# People, access and audit

> Where membership and roles, single sign-on, support access and the audit log are documented — one page each — and where the permission matrix went.

_Concept · Updated 2026-10-17 · Describes release 0.1.164_

**Settings · Account → Members & roles** (`/portal/members`) manages membership, roles, single sign-on and workspace features; **Settings · Account → Audit log** (`/portal/audit`) holds the append-only trail you hand to an auditor; **Appearance** sets the brand for everyone. Access is a set of sixteen permission keys grouped into roles, membership is the only door to your data — platform staff have no bypass, only an expiring grant you can see and revoke — and every consequential act lands in a hash-chained audit log that nothing edits. This chapter is now one page per subject; what leaves your network and where credentials live stays in **Security and data**, and every term is defined once in the **Glossary**.

## The pages {#the-pages}

- [Members and roles](/help/members-and-roles.md) — invite, re-role and remove members, create custom roles, what every workspace includes, the tenant brand, roles and personal preferences.
- [Single sign-on](/help/single-sign-on.md) — register this platform at your provider, connect it, map groups to roles, test discovery, what login looks like, why SSO can never mint a tenant admin.
- [Support access](/help/support-access.md) — the break-glass grant platform staff use when you ask for help, and what staff can and cannot see without one.
- [Audit log](/help/audit-log.md) — what is recorded, filter and search, verify the chain, export evidence for an auditor, what the log records for a notification.
- [Permissions](/help/permissions.md) — the reference: the permission matrix and the navigation and action permissions per destination.

## Where the old sections went {#where-the-old-sections-went}

| Old section | Now |
|---|---|
| Concepts | Account vs membership, role and included features on [Members and roles](/help/members-and-roles.md#concepts); the permission key on [Permissions](/help/permissions.md); no superadmin bypass on [Support access](/help/support-access.md); the hash-chained audit on [Audit log](/help/audit-log.md) |
| The permission matrix · Navigation and action permissions | [Permissions](/help/permissions.md#the-permission-matrix) |
| Create a custom role | [Members and roles](/help/members-and-roles.md#create-a-custom-role) |
| Managing members · Feature availability · Appearance | [Members and roles](/help/members-and-roles.md#managing-members) |
| Per-tenant SSO | [Single sign-on](/help/single-sign-on.md#per-tenant-sso) |
| Support access (break-glass) · What platform staff can and cannot see | [Support access](/help/support-access.md#support-access-break-glass) |
| The audit log · Notification setup checks | [Audit log](/help/audit-log.md#the-audit-log) |
| Use cases, troubleshooting, limits and gotchas | Each page keeps the rows about its own page |


## Next steps

- Next: [Members and roles](/help/members-and-roles.md)
- [All Administer a workspace pages](/help/administer-a-workspace/llms.txt)
- [Documentation home](/help/)