Identity
HEAT ships with a built-in identity service called HEAT Auth. It holds user accounts, roles and the personal details that go with them, and it issues the token you sign in with. The Identity section is where you manage those accounts. Open Platform, then Identity (/admin/identity).
The user list
HEAT Auth users (/admin/identity/heat-auth-users) lists every account with its username, email, role and status. Search by username, name or email, or filter by role. A coloured chip shows each role, and the status shows whether the account is active.
The ⋯ menu on each row is a shortcut to Edit and Delete. My account (/admin/identity/account) shows your own profile and a password change.
The four roles
Every account has one role. It decides what the user sees in the HEAT dashboard and in the Control Centre.
| Role | HEAT dashboard | Control Centre |
|---|---|---|
| Administrator | Everything, including the dashboard Users page | Every section |
| Instructor | Every session and the reports | No access |
| Trainee | Only the sessions they took part in | No access |
| Developer | The same as an Administrator | Every section, with a few Administrator-only controls |
Creating a user
Press Create user (/admin/identity/heat-auth-users/create). The form issues credentials directly and sends no email.
- Press Generate credentials to fill in a strong password, then Copy it. The password is shown once and cannot be retrieved later, so store it before you submit. The user is prompted to change it on first sign-in.
- Fill in the Username and Email. First name, last name, title and company are optional.
- Choose the Role. New users default to Trainee.
- Press Create user.
HEAT Auth sends no account email. On an air-gapped site there is no email at all, so every account is created here and the password is handed to the user directly. There is no self-service invitation or password reset. To reset a locked-out user, edit their account and set a new password from this section.
Editing a user
Open a user, or choose Edit from the row menu (/admin/identity/heat-auth-users/edit/...). You can change the username, email, name, title, company and role, then Save changes. Delete user removes the account. To stop someone signing in without deleting them, change their role or delete the account here.
Where personal details live
HEAT Auth stores email, name, title and company. Nothing else in HEAT does.
The analytics core identifies a person by a numeric id linked to their HEAT Auth account through an opaque identifier. Sessions, dimensions and node outputs carry that id, never a name or an email. The Control Centre shows personal details only on these Identity screens. Session and runner views show identifiers.
This boundary is deliberate and it is mandatory in defence deployments. Architecture and boundaries explains it alongside the other boundaries of the platform. If a person must be forgotten, remove or deactivate them in HEAT Auth. There are no names to chase inside the analytics data.