Users and roles

Sill dashboard users are humans who sign in to manage an Account. Each user belongs to exactly one Account, holds one of four roles — owner, admin, reviewer, viewer — and moves through a lifecycle of invited, active, suspended, deactivated. Authentication is magic-link only: Sill stores no passwords, and SSO is on the roadmap, not available today.

Account and user model

An Account is the top-level merchant org. A User is a person on your team who signs in to that Account. Each user has:

Attribute	Description
Email	The sign-in identifier — magic links are sent here. One user belongs to one Account.
Name	Display name shown across the dashboard.
Role	One of `owner`, `admin`, `reviewer`, `viewer` — see Roles.
Status	`invited`, `active`, `suspended`, or `deactivated` — see Lifecycle.

Sill stores no passwords — sign-in is by magic link only.

Sign-in is magic-link only. The flow:

You enter your email address on the dashboard.
Sill emails you a one-time sign-in link — short-lived and single-use.
Clicking the link signs you in.

On a first-ever sign-in for an email, Sill automatically creates an Account with you as the owner — there is no separate signup form. You can then invite teammates.

sequenceDiagram
  participant U as You
  participant S as Sill
  participant E as Email

  U->>S: Enter your email
  S->>E: Send a one-time sign-in link
  E-->>U: Email with the link
  U->>S: Click the link
  alt First sign-in for this email
    S->>S: Create your Account (you become the owner)
  else Returning user
    S->>S: Sign you in
  end
  S-->>U: Signed in

You stay signed in across the Sill dashboard and marketing site. Only active users can sign in — invited, suspended, and deactivated users are turned away.

Roles

Roles are enforced by Sill on every privileged action — the dashboard hides what you can’t do, and the server independently refuses it regardless.

owner — full write access across the Account. Created automatically on first sign-in for a brand-new Account. Can change merchant-wide configuration such as buyer-detail retention, settlement rail, and the active policy.
admin — the same write access as owner today. The distinction exists for org clarity and future delegation (e.g. owner-only transfer of the Account, billing changes).
reviewer — read access plus the ability to triage the escalation queue and decide individual escalations (approve / reject / dismiss). Cannot change sites, policies, catalogs, or account settings.
viewer — read-only across the Account. Useful for analysts, auditors, and compliance reviewers who need visibility without write power.

Roles versus permissions

The table below shows what each role can do today. Where a row says “read only,” the user can view the resource but cannot create, change, or delete it.

Capability	owner	admin	reviewer	viewer
View dashboard, sites, audit log	yes	yes	yes	yes
Create / modify sites	yes	yes	read only	read only
Verify a domain (domain verification)	yes	yes	read only	read only
Publish or change the active policy	yes	yes	read only	read only
Manage the merchant catalog	yes	yes	read only	read only
Manage the agent-card profile	yes	yes	read only	read only
Manage settlement-rail configuration	yes	yes	read only	read only
Configure account-wide buyer-detail retention	yes	yes	read only	read only
Triage / decide HITL escalations	yes	yes	yes	read only
Export a signed audit bundle	yes	yes	read only	read only
Run red-team drills	yes	yes	no	no
Reveal buyer-detail PII (gated, audited)	yes	yes	no	no

If you attempt an action your role doesn’t allow, Sill refuses it. Your role is set by Sill and tied to your sign-in — it can never be changed by the browser or claimed by the client.

Lifecycle

A user moves through four states. Only active users can sign in.

flowchart LR
  invited --> active
  active --> suspended
  active --> deactivated
  suspended --> active
  suspended --> deactivated
  deactivated --> active

invited — the user record exists but the human has not yet completed first sign-in. Sessions are refused until they accept.
active — can sign in via magic link and exercise the permissions granted by their role.
suspended — temporarily blocked from sign-in. The record and history are preserved. Reversible — reactivate at any time.
deactivated — off state. Sessions are refused and the user can no longer sign in. Any activity or audit history referencing the user remains intact. Deactivation is reversible: an owner or admin can Reactivate the member, or re-invite their email address — which brings the same member back and sends a fresh sign-in link.

An owner or admin can also delete a member who never signed in and has no history — a mistaken or never-accepted invite — which removes the row entirely and frees the email address to be invited again. A member with any history cannot be deleted; deactivate them instead, so their history is preserved.

Any status other than active prevents sign-in: a suspended or deactivated member must be reactivated (or re-invited) before they can sign in again, even if they were signed in before.

Sessions

Staying signed in — a session lasts up to 14 days and renews as you keep using the dashboard. You stay signed in across the Sill dashboard and marketing site.
Sign-in — Sill stores no passwords; you sign in with a one-time magic link sent to your email.
Ending a session — signing out ends it immediately. Each member can review and revoke their own active sessions, and an owner or admin can sign a member out of every device at once. See Member activity and sessions for the full session view and remote sign-out.

What is not yet available

These items are part of the published roadmap, not present-day capability. They are listed here so the docs stay honest about Sill’s bounds.

SSO / SAML / OIDC. Not available today. SSO is on the roadmap.
MFA / TOTP. Not available today; the magic-link sign-in is the only method.
Granular per-site roles. Roles apply across the whole Account, not per site. A user who is viewer on the Account is viewer on every site in it.
API keys. Programmatic credentials issued from the dashboard are on the roadmap.

Frequently asked

A new Account and a single owner user are created the first time you sign in with a magic link. The Account name and user name default from your email; you can change both from account settings.

Can a user belong to more than one Account?

No. Each user belongs to exactly one Account. To work in two Accounts, sign in with two different email addresses.

What happens to a deactivated user’s audit history?

It stays. Deactivating a user changes who can sign in, not the record of what they did — activity and audit history are permanent and tamper-evident. Past mandate decisions and escalation resolutions that reference the user remain intact.

How do magic-link tokens stay safe?

The sign-in link exists only in your email and the moment you click it — Sill never stores the link itself, only a one-way fingerprint of it. Links are short-lived, single-use, and rate-limited, so a link can’t be reused, replayed, or guessed.

Why are `owner` and `admin` enforced identically in many places?

Today most write actions accept either role. The distinction is reserved so that owner-only actions — like transferring the Account or future billing controls — can be enforced later. Treat owner as “the seat that can change the seats.”

Can I assign Sill roles to a third-party AI agent?

No. Roles describe human dashboard users. AI agents are identified separately by their signed agent card, not by a dashboard sign-in. The two are deliberately kept apart.