Roles

Camper has two audiences in every workspace:

Audience	Who they are	What they use Camper for
Operators	IT / identity / SaaS admins who run the product	Connect apps, shape the catalog, link resources, fix drift
Workers	Everyone else in the directory	Check what access they have (My Access)

Both audiences are people in your IdP. SCIM pushes them as directory identities. A small roles value on that same user decides whether they get the operator dashboard or My Access only.

Sign-in (SSO, email code, passkeys) is separate — roles answer what they can do after they sign in.

Role catalog

Use exactly these values when you map roles in your IdP (matching is case-insensitive; send the spelling below so audits stay readable).

IdP value (`roles`)	Platform role	Audience	What they can do
`Admin`	Admin	Operators	Full dashboard: Connections, People, Catalog, Resources, Activity, Settings
`Viewer`	Viewer	Workers	My Access and their own account settings
(omit or empty)	Viewer	Workers	Same as `Viewer` — safe default for the workforce

Workspace owner (not from the IdP)

Role	How it is set	What they can do
Owner	Automatically when someone creates the workspace	Same operator UI as Admin, plus ownership (billing and similar)

Do not send Owner from SCIM. Camper rejects that value so the IdP cannot invent a second owner. Give additional operators Admin.

An existing owner is not demoted if SCIM later sends Admin or Viewer for the same person.

What about `Member`?

Camper still accepts Member for older mappings, but it does not open the operator dashboard (same worker shell as Viewer). Do not use Member in new IdP configs.

What each audience is for

Operators (`Admin` or Owner)

People who maintain SaaS access against the org chart.

They can:

Connect and health-check target apps
Manage SCIM tokens, SSO, and org structure
Link org units to groups, channels, teams, and similar resources
Review activity and retry failed provisioning
Manage billing (owner and admin)

They cannot assign Owner through invites; ownership stays with workspace creation.

Workers (`Viewer` or no role)

Employees, contractors, and anyone who only needs to understand their own access.

They can:

Open My Access — org units and expected resources
Manage their own sign-in methods under Account settings

They cannot open Connections, resource linking, the catalog, or identity admin settings. Operator URLs redirect them to My Access.

How to set roles from your IdP

You need SCIM working first (SCIM provisioning, plus your IdP guide).

Recommended pattern

Create a small operator group in the IdP (for example “Camper Operators”).
Map a user attribute to SCIM roles:
- Operators in that group → Admin
- Everyone else → Viewer, or leave empty
Push users as you already do. Role changes apply on the next update; deactivating someone removes their Camper access for this workspace.

Population	`roles` value
Camper operator group	`Admin`
All other assigned users	(omit) or `Viewer`

Tips

Prefer one operator value: Admin. Do not invent parallel strings in new setups.
Prefer group-based assignment over hand-editing individuals.
After SCIM and SSO are both live, Camper hides in-app operator invites — elevation should stay in the IdP. See People.

Vendor notes: Okta, Entra ID, Custom attributes.