Top-Level Administrative Account Role Definitions

Select a User Type for least privilege level. An admin account is the most privileged account with complete control over your organization's Legion instance.

Role Name	Permissions & Operations	Operational Scope
Admin	Can perform Org Management, manage Entities, Feeds, Tasks, and Integrations.	High-level system configuration and user oversight.
Member	View and edit data from organizations they are part of; No Org Management.	Operational data management within a specific scope. Auditing and monitoring only.

Admin Account Lifecycle Procedures

Admin account provisioning

New admin accounts should be created via the "Add User" interface using an organization-approved email domain. Providers should set all initial settings to recommended secure defaults upon provisioning.

Multi-factor Authentication(MFA)

MFA is mandatory for all account levels. MFA methods are defined at the organization level. Depending on your organization and the cloud location of where the Legion instance resides on MFA methods may include, but are not limited to, FIDO2/WebAuthn hardware keys (e.g., YubiKey) and PKI-based authentication (PIV/CAC cards).

Configuration

Once the organization is established by the Picogrid System Administrator, they will also create an owner/primary admin account. This owner/primary admin is granted the authority to manage user access, including adding or removing users and assigning administrative roles.

Decommissioning

Use the Remove user (trash can icon) to revoke access immediately upon a user's departure or role change. Revocation must be timely to prevent unauthorized access.

Security Settings Reference Table

The table below describes settings that only top-level admins can control.

Setting Name	Associated Function	Security Impact	Recommended Value
Org Management	Grants the ability to add/remove users and change roles.	Critical: High risk of unauthorized privilege escalation.	Restricted to < 3 users.
Integrations	Manages external API and service connections.	High: Risk of data exfiltration to unauthorized third parties.	Enabled only for vetted services.