Access & Roles for Firms

Audience: Firm owners and managers · Where: Firm Administration → Teams & Access for your staff; the client's Users tab and Administration → Members for client users.

Overview

Two kinds of people work in a client organization:

• Your firm's staff, who reach clients through their firm role or a team grant.
• The client's own users (MSSPs only), invited directly into the client.

How your staff reach clients

Your role at the firm	Which clients you can reach	Your role inside each client
Owner or Manager	Every active client, automatically.	The same as your firm role.
Member or Viewer	Only clients your team has been granted.	The role set on the grant.

Inside a client you act with that role: for example, schedule assessments, triage findings, configure attack-surface monitoring, and (as Manager or above) manage the client's users and settings. The header badge Acting as · always shows the role you're using.

Giving your team access to clients

Use teams to give staff who aren't firm owners or managers access to specific clients:

1. In your firm's Administration, open Teams & Access and select a team (or create one and add members).
2. In the team's Client access section, choose a client from Grant client…, pick the role the team should have there (viewer, member or manager), and click Grant.
3. Repeat for each client. Remove a grant from the same list to take access away.

Members of a team with no grants (who aren't firm owners or managers) won't see any clients.

Inviting the client's own users

Inside a client, the Users tab lists everyone with access to that client, including pending invites. Invites are audit-logged against both your firm and the client.

To invite someone, click Invite user (visible if your role on the client is Manager or higher), enter their email and choose a role: Manager, Member or Viewer. To change a user's role or remove them, use the client's Administration → Members.

What you can do depends on your firm type:

MSSPPentest firm

You can invite the client's own staff. The highest role you can give them is Manager; a client user can never be made Owner of the client organization.

You can't invite people from outside your firm into a client. Only existing members of your firm can be given access, through their firm role or a team grant. Inviting an outside email fails with "Pentester firms cannot invite external users to child orgs".

What client users see

Client users get the standard Canima portal for their own organization: the dashboard, assessments, findings, reports, attack surface and so on, exactly as described in the rest of these docs. They don't see your firm, its other clients, the Clients hub or Portfolio.

Their Licenses page shows the capacity you've allocated to them. Their SLA targets show as Inherited from your firm unless the client sets its own.