Staffs
Staffs
Staffs is the operator-side access-control surface for human dashboard accounts.
Dashboard path
Operator Dashboard → Integrations → Staffs
Required scope: staffs:read
Mutation scope: staffs:write
Staff APIs require a human staff session. Operator API keys cannot create, edit, disable, or reset staff accounts.
What operators can do
- create staff accounts by email
- assign dashboard scopes
- edit display names
- enable or disable staff membership
- reset another staff member's password
- see last login and must-change-password state
Search matches email, display name, or assigned scope text. Status filters are All, Active, and Disabled. The table shows the staff membership; a dashboard role label does not override explicit scopes.
Scope assignment rules
*is not assignable to newly created dashboard staff through this UI.- Write scopes automatically include the matching read scope when one exists.
- A staff member can assign only scopes they already hold, unless they have
*. - A staff member cannot update or disable their own access.
- Access and password changes revoke the target staff member's active sessions.
- Full access selects all currently assignable named grants, not a new wildcard grant. Saving a legacy wildcard account through this editor replaces its wildcard with the displayed explicit selection; review it before saving.
Useful permission bundles
| Workflow | Staff grants |
|---|---|
| User/order investigation | users:read, trades:read |
| Resolved-market user cash PnL | trades:read and redemptions:read |
| Cash Flow Triage evidence | trades:read, redemptions:read, and balance_operations:read |
| Opinion monthly reports/exports | settlements:read (independent of trade/redemption grants) |
| Market visibility | markets:read; add markets:write only for authorized changes |
| Private Market Requests (unreleased) | markets:read to review; both market grants to submit risk acceptance |
| Operator Support | Active human staff session; no extra feature scope |
Grant only the duties needed. Giving an employee cash-flow read access does not authorize them to reconcile in Polynion Admin, send money, or write off unpaid payouts. Market write access includes production-impacting visibility and, when available, private-market risk acceptance; do not grant it as a reporting shortcut.
Onboarding password behavior
Create and reset flows attempt to email a temporary password.
If email delivery succeeds, the API does not return the temporary password.
If email delivery fails, the dashboard can show the temporary password once as a fallback so the operator can complete onboarding manually.
Share fallback passwords only through an approved private channel, never a support ticket. The new/reset account must change its temporary password at sign-in. If the email already belongs to an account (EMAIL_EXISTS), do not try to link it by changing unrelated accounts; ask the operator administrator or Polynion Support to resolve account ownership.
Source API
The page uses staff-session bearer auth against:
GET /api/operator/staff
POST /api/operator/staff
PATCH /api/operator/staff/{membership_id}
POST /api/operator/staff/{membership_id}/reset-password
See /docs/operator-api/staffs for request and response details.