Nodlyn identity lives on Nodlyn Cloud. On-prem Studio no longer stores passwords or a local Users table — it mirrors the cloud roster into memory for sessions and permission checks.
Where accounts are managed
| Surface | What it does |
|---|---|
| Nodlyn Cloud | Source of truth: sign-up, login, password reset, team members, licenses. |
| Studio → Admin → Users | Proxies to Cloud. Add / disable / delete team members and reset passwords need Cloud reachable. If Cloud is offline, Studio may show the last mirrored roster read-only. |
Cloud Admin (/admin) | Platform operators (Nodlyn staff) — license approvals across tenants, not your account team. |
Cloud:ControlPlaneUrl, e.g. http://localhost:5213) or confirm production Studio points at https://nodlyn.com.
Roles (cloud account)
| Role | Who | Typical permissions |
|---|---|---|
| Admin | Account owner (the person who registered the workspace) | Manage team members, global settings, security, and full Studio access. |
| Operator | Team members invited by the account owner | Design and run workflows, Jobs, variables, approvals — not user administration. Shares the owner’s workflow / agent namespace. |
Fine-grained Studio roles from older on-prem builds (Viewer, Auditor, Supervisor) are not stored on Cloud today. Team members are Operators; the account owner is Admin.
Disable vs delete
- Disable — blocks login (license rejected); can Reactivate later.
- Delete — permanently removes the team member from Cloud. Agents remain owned by the account owner.
On-prem Studio cache
After an Operator signs in, Studio keeps their session and ownerUserId in memory. Workflows and agents resolve to the account owner, so Operators see the same workspace. If Studio restarts while Cloud is offline, they must sign in again when Cloud is reachable — there is no offline password store.
Audit trail
Activation, approval, and export events are logged with user and timestamp. Auditors review history without edit rights where that role still applies in Studio session context.