> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Access and roles in Lerian Cabine

> How operators sign in to Lerian Cabine and the roles that Access Manager grants them.

Operators sign in to Lerian Cabine through Access Manager. Access Manager decides what each operator may do.

## Sign in

***

On the sign-in screen, enter the Access Manager **Usuário** and **Senha**. Then select **Entrar**.

Cabine asks for a code when Access Manager requires one. Enter the code and select **Verificar**. For the setup of this second step, see [Multi-factor authentication](https://docs.lerian.studio/en/platform/access-manager/features/mfa/overview).

## Session

***

Cabine keeps the session in the browser's memory. Reloading the page signs the operator out.

When a request answers `401`, Cabine renews the token once and repeats the request. If the renewal fails, Cabine signs the operator out.

## Who may do what

***

Cabine shows every workspace and every action to every operator. Each rail and the Cabine API check the operator's permissions on each request.

## Roles on the rails

***

These rail pages name the roles or permissions that Access Manager grants for the rail:

* [Lerian SISBAJUD](https://docs.lerian.studio/en/rails/sisbajud/sisbajud-operations.md#roles)
* [Lerian SRC](https://docs.lerian.studio/en/rails/src/src-integration.md#authentication-and-permissions)
* [Lerian BC Correios](https://docs.lerian.studio/en/rails/bc-correios/bc-correios-integration.md)
* [Lerian SCR](https://docs.lerian.studio/en/rails/scr/scr-integration.md)

## Roles on the Cabine API

***

The Cabine API has three roles. Access Manager groups grant them.

| Role | Access Manager groups |
| - | - |
| `viewer` | `br-desk-viewer-group` |
| `operator` | `br-desk-operator-group` |
| `admin` | `admin-group` (the Access Manager administrator group), `br-desk-admin-group` |

| Role | What the role may do |
| - | - |
| `viewer` | Read acknowledgements, shift handoffs, user deletion requests, and manual review approvals. |
| `operator` | Everything a `viewer` may do. Also acknowledge and reopen alerts, create, submit, and approve shift handoffs, and propose and decide manual review approvals. |
| `admin` | Everything an `operator` may do. Also request, approve, and reject user deletions. |

An application can hold these roles too. A person, not an application, approves a shift handoff, decides a user deletion, and proposes or decides a manual review approval.

## When a different person must approve

***

The Cabine API refuses an approval from the person who made the request in three cases:

* A shift handoff. The approver differs from the author and from the person who submitted it. See [Alerts and shift handoff](https://docs.lerian.studio/en/rails/cabine/cabine-alerts-and-handoff.md).
* A user deletion. See [Administration](https://docs.lerian.studio/en/rails/cabine/cabine-administration.md).
* A manual review approval. See [Manual review approvals](https://docs.lerian.studio/en/rails/cabine/cabine-manual-review-approvals.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.