Product Access on the Selection Screen
After signing in, users land on the product selection screen — a grid of tiles, grouped by category, covering the products their organisation has.
Every product the tenant has appears on that grid. Products the user's roles give them access to are available and open when clicked. Products their roles do not cover are shown disabled: dimmed, not clickable, marked with a padlock and the note "Not included in your role."
Two different questions decide what a user sees, and it is worth keeping them apart. Whether the tenant has the product at all is set on the tenant, and a product it does not have is not on the grid. Whether this user may open it is set by their roles, and a product they are not granted is on the grid but disabled. The first is not something an administrator of the tenant can give you; the second is.
Why disabled instead of hidden
Previously the grid showed only the products a user's roles granted, and everything else was left out. That made an un-granted product indistinguishable from one that does not exist — a user could not tell whether Beak offers a capability at all, or whether they simply have not been given it. A user whose roles granted no products saw an empty screen with no explanation.
Showing the full portfolio with the un-granted tiles disabled means:
- Users know what to ask for — they can see what Beak offers and request the parts they need, naming the product in front of them.
- Administrators get visible evidence — a tile that is available when it should not be, or disabled when it should not be, is now something you can see on the screen rather than a silent absence.
- No more empty screen — a user whose roles grant nothing sees the portfolio, disabled, instead of a blank page.
A disabled tile is a presentation state, not a security control. It reflects what the user's roles grant; it is not what enforces the boundary. See What a disabled tile does and does not do.
What controls whether a tile is available
A tile is available when any active role assigned to the user includes that product.
Product access is set per role, so:
- Open the admin console and go to Roles.
- Open (or create) a role and use the Products selector to choose which products it grants.
- Assign the role to users under Users.
A user with more than one role gets the union of the products those roles grant. Deactivating a role immediately removes the product access it granted.
Changes take effect the next time the user loads the product selection screen. There is nothing to redeploy, and users already signed in do not have to sign in again.
Note: A tenant now has its own set of products, chosen when it is created and editable on its page. Roles work exactly as described here within that set. Until an administrator chooses an explicit set for a tenant it has every active product, which is how every tenant behaved before, so on those tenants product access is still expressed entirely through roles. See Creating a Tenant.
When there is only one product to open
A user whose roles leave exactly one product available does not see the selection screen at all. Beak opens that product for them directly. A grid with a single available tile asks the user to make a choice they do not have, on every single sign-in.
This applies wherever the selection screen would otherwise appear — after signing in with a password, after single sign-on, and on returning to the platform address in a session that is already signed in.
- The un-granted products are skipped with it — a user with one available product and a portfolio of disabled ones goes straight into their product and does not see the disabled tiles. While they have one product they cannot reach the grid: the platform address opens their product too.
- A set of tiles that share one application counts as one product — where several products open the same application (the Observability rows, for example), there is one place to go, so the user is taken straight in.
- The product opens in the current tab — regardless of the tenant's Product Launch Behavior setting. A browser blocks a new tab that the user did not open by clicking, so an automatic launch always uses the tab the user is already in.
- A no-access message still shows the grid — if a product turns the user away, they arrive back on the selection screen with the explanation, and Beak does not send them straight back into that product.
- Granting a second product brings the screen back — the user sees the grid again the next time they sign in.
Note: To give a single-product user the wider portfolio view — so they can see what Beak offers and ask for it — grant their role a second product. There is no setting that forces the selection screen to appear for a user who has only one.
What a disabled tile does and does not do
A disabled tile is a presentation state. It is not the security boundary.
- Each product enforces its own access — if a user reaches a product another way (a bookmark, a shared link, a direct URL), that product checks their access itself and returns them to the product selection screen with an explanatory message. Disabling the tile removes the obvious route in; it is not what stops entry.
- No customer data is exposed — the grid carries product names, descriptions and the platform address of each product. It holds no tenant data and nothing about other organisations.
- Granting access is always an administrator action — nothing on the selection screen lets a user grant themselves a product.
Products that stay hidden entirely
Three cases are left off the grid completely, because none of them is about the user's role:
- Products the tenant does not have — a product outside the tenant's own product set is not shown to anyone in that tenant. This is the case a user's administrator cannot fix by editing a role; the tenant needs the product added on its page first.
- Retired products — a product deactivated in the platform product registry is removed for everyone. A retired product is gone, not shown disabled.
- Products not configured for the environment — if a product has no address configured in the current environment, its tile is hidden rather than shown with an address that leads nowhere.
Troubleshooting
| What you see | What it means |
|---|---|
| A tile is disabled but the user should have it | No active role assigned to that user includes the product. Check the role's Products selector, and that the role is active and actually assigned. |
| A tile is available but the user should not have it | One of the user's roles includes it. Check every assigned role — access is the union across all of them, so a second, broader role is the usual cause. |
| Every tile is disabled | The user's roles grant no products, or they have no active role assigned. |
| A product is missing from the grid altogether | The tenant does not have that product, or it is deactivated in the product registry, or it is not configured for this environment. None of these is a role problem — check the tenant's Products & Provisioning card first. |
| The user opened a product and was sent back with a message | Expected: the product enforced its own access check. Grant the product on one of the user's roles. |
| A user never sees the selection screen at all | Their roles leave exactly one product available, so Beak opens it directly. Grant a second product and the grid returns at their next sign-in. |
| A user still skips the screen after being granted a second product | The grid is read from the copy cached in their browser at sign-in. Have them sign out and back in. |