Users and roles

Every person who uses Sift signs in with their own account, and each account holds one of three roles. As an admin you create accounts, change their role, and disable them under the gear icon (Administration) › Users. This page also covers passwords, sessions and the seeded admin account.

Sift signs people in with a local username and password. It has no single sign-on and no multi-factor authentication.

Roles

The server checks the account’s current role on every request. The console hides controls a role cannot use, but hiding them is a convenience: a reviewer who reaches an operator endpoint is refused by the server.

Role	The console describes it as	What it can do
`reviewer`	Labels gold sets and reads dashboards. Cannot change what a filter does.	Read every filter, the dashboard, Actions, alerts and logs. Label gold-set items. Answer the verdict check.
`operator`	Authors filters, runs training, and approves thresholds.	Everything a reviewer can, plus: create filters (Sift’s assistant and agent analysis), connect a filter to its agent, change settings and stages, build and approve the gold set, approve a threshold, start a bake-off and promote its winner, hold, stop, resume and retire filters, import or clear label history, decline asks, switch the verdict check on or off.
`admin`	Manages users and the Kindo credential. Inherits everything below.	Everything an operator can, plus the Administration area: the Kindo connection, users, filter recipes, the decision model, notifications and the audit log.

Approvals, the gold set and the threshold, need operator or admin. The console shows a reviewer those forms, and the server refuses the request.

A non-admin who opens an Administration address sees: “Administration requires the admin role. Your account holds {role}.”

Give each person the narrowest role that lets them do their job, as the screen’s Add an account panel says.

The Users page

The Accounts table lists every account with its Username, Role, Created, Last signed in (or never), Status (active or disabled) and a Change column.

Add an account

In Add an account, enter a Username.
Enter the first password in Password and again in Confirm password.
Choose a Role. The form starts on reviewer.
Select Create account.

The account appears in the table, active. Tell the person their username and password through a channel you trust; Sift does not email anyone.

Field	Rule
Username	Letters, digits, dot, underscore and hyphen only; at most 64 characters. Sign-in matches it without regard to case, so do not create two accounts that differ only in case.
Password	At least 12 characters, at most 72 bytes once encoded as UTF-8. A longer one is refused rather than stored with its end ignored.

The person is not asked to change this password when they first sign in. Suggest they do, from the account menu.

Change a role

In the account’s row, pick the new role in the Change column.
Select Change role.
Read the consequence and select Make {role}.

Every session the account has open ends at once, and the person signs in again to see the console for their new role. Their requests are refused or allowed under the new role from that moment either way.

Disable or re-enable an account

Select Disable in the account’s row.
Select Disable account.

The person can no longer sign in, and every session they have open ends. Nothing is deleted: their audit history stays, and Sift has no way to delete an account. To let them back in, select Re-enable. The account comes back with the same password and no open sessions.

A disabled account’s sign-in fails with the same “Incorrect username or password.” as a wrong password, so the sign-in form never reveals which accounts exist.

What you cannot change

Your own account. Your row shows you instead of controls. Another admin changes your role or disables you, so there is always someone left who can undo it.
The last active admin. Sift refuses to demote or disable the only active admin: “{username} is the last active admin, so they cannot be demoted. Make another account an admin first.” Only an admin can make another admin, so a deployment without one cannot be recovered from the console.

Asking for the role or status an account already has changes nothing and ends no session.

Passwords

Anyone can change their own password from the account menu (the person icon in the header, titled Account: {username}) › Change password. The form asks for the Current password, the New password (at least 12 characters, different from the current one) and Confirm new password.

Changing it signs the account out everywhere else; the browser you used stays signed in. An admin cannot set or reset another account’s password. If someone forgets theirs, create them a new account and disable the old one.

Sessions

A session lasts 12 hours from sign-in (SIFT_SESSION_TTL_HOURS, default 12), then the person signs in again.
Sign out in the account menu ends every session of the account, on every device, not only the one in this browser.
A role change, disabling, re-enabling or a password change also ends every session.

Failed sign-ins are counted for 15 minutes in two budgets, and running out of either refuses further attempts with “Too many failed sign-in attempts. Try again shortly.”

Budget	Limit in 15 minutes
Per username (case-insensitive)	10 failed attempts
Per client address	30 failed attempts

Each failure restarts the 15-minute window, so sustained guessing stays blocked. A successful sign-in clears the count. A wrong current password on the change-password form counts against the same per-username budget.

There is no permanent lockout, by design: a lockout would let anyone who knows a username keep that person out of Sift. Failed and throttled sign-ins are written to the audit log (auth.login_failed, auth.login_throttled), which is where to look for someone guessing.

Behind a load balancer, set SIFT_TRUSTED_PROXY_HOPS so the per-address budget counts the real client; see Configure Sift.

The seeded admin account

On first start Sift creates one admin account, admin unless SIFT_DEFAULT_ADMIN_USERNAME says otherwise, with the password in SIFT_DEFAULT_ADMIN_PASSWORD (default admin). Restarts never reset it.

While that account still has the shipped password admin, every page shows a banner that cannot be dismissed, Default administrator password still in use, with a Change password button. Sift holds a Kindo API key, so a guessable admin password is a way into your Kindo tenant for anyone who can reach the console. The banner clears only when that account’s password is changed.

The audit log: every account change and sign-in, with who made it.
Security and data handling
Configuration reference