The account is recognized
Firebase Authentication confirms identity and session state for flows that use it.
Help Centre · Security and data
What is documented today about roles and permissions?
The dossier confirms authentication for protected flows and group-based access control in certain contexts. The complete matrix by collection and endpoint still has to be finalized.
Do not infer a complete matrix from a single flow.Actual access also depends on deployed Firestore rules and the consistency of user documents.
Two mechanisms are explicitly confirmed
Firebase Authentication manages authentication and session state for documented protected flows. Some controls also read users/{uid}.groupId, including administrator group 1. The dossier states that effectiveness depends on the deployed Firestore rules and that the complete role and permission matrix remains to be completed.
02Concepts
Distinguish what actually protects a flow
These elements work together, but none of them alone describes every access rule in the product.
A control may read groupId
Some documented flows use users/{uid}.groupId, including administrator group 1.
Access also depends on Firestore
The dossier states that the control depends on the Firestore rules actually deployed and on consistent user documents.
Organization's responsibility. The organization remains responsible for determining who should use its accounts and for protecting its credentials. Applicable obligations should be reviewed in the relevant contractual terms.
03Verification
Verify an access rule without generalizing it
When access needs to be confirmed, test the exact flow with an authorized account and document the result instead of assuming another screen behaves the same way.
- Choose the exact flow. Note the page or function being verified.
- Use an authorized account. Test with a representative account without sharing its credentials.
- Compare expected and observed behaviour. Check the expected information or action, then record the result and exact message.
- Keep only useful evidence. Clean screenshots and never send a password, code, key, token, or secret.
Caution: A test on one specific flow does not automatically describe access on other pages. The complete role and permission matrix still has to be finalized.
Guardrails
What the dossier does not yet support claiming
The complete role and permission matrix by collection and endpoint is one of the governance items still to be finalized.
- A universal permission matrix for every account.
- That every permission can be configured independently in the interface.
- That administrator group 1 describes every possible role.
- That a control observed in one flow automatically applies to other pages.
Related resources
Continue the review
Choose the resource that matches the organizational, contractual, or technical question you need to clarify.
Support
Contact supportReport an access discrepancy
If an account unexpectedly can or cannot see information, note the page, account context, expected action, observed result, and exact message. Do not send login credentials or secrets.