# Troubleshooting & FAQ

> Access problems are almost always roles or invitations. Which role grants what, why an invitation does not arrive, and why someone sees nothing after login.

Source: https://tidalcontrol.com/docs/personnel/troubleshooting-and-faq

Access problems are almost always about roles or invitations: which role grants what, why an invitation does not arrive, and why someone sees nothing after logging in. Strict Mode adds a second layer of access control, which is the usual cause of the last one.

## Frequently asked questions

### What is the difference between the roles?

Four global roles exist. Basic User stands on its own for staff who only accept policies. The other three are each a superset of the last: Read Only, Regular, and Super User.

**Role-based access control in Tidal Control:**

**Basic User:**
- **Access:** Onboarding and the incidents they submitted themselves
- **Limitations:** Cannot reach controls, assets, risks or reports
- **Use:** Employees who only need to read and accept their policies
- **Strict Mode:** Unchanged

**Read Only User:**
- **Access:** Can view all compliance data (controls, assets, risks)
- **Limitations:** Cannot change anything, execute tasks, or upload evidence
- **Use:** External auditors, management oversight, reporting specialists
- **Strict Mode:** Unchanged

**Regular User:**
- **Access:** Everything from Read Only plus execution rights
- **Capabilities:** Execute tasks, upload evidence, be assigned as owner
- **Limitations:** Cannot manage other users or change global settings
- **Use:** Compliance staff, control owners, daily users
- **Strict Mode:** Needs object-level roles for access

**Super User (Administrator):**
- **Access:** Full system rights
- **Capabilities:** Manage users, global settings, all functionalities
- **Responsibilities:** System management, user onboarding, configuration
- **Use:** IT administrators, compliance managers, implementation specialists
- **Strict Mode:** Unchanged

### How can a user update their own profile?

Users manage their own profile through Keycloak, reached from the profile icon in the top-right corner.

**Keycloak account access for personal data:**

**Access to account settings:**
1. **Log in** to Tidal Control
2. **Click profile icon** top right (user avatar)
3. **Select "My preferences"** from dropdown menu
4. **Keycloak interface opens** in new tab

**Editable personal information:**
- **Email** - Contact address for system notifications
- **First name / Last name** - Names as displayed in Tidal interface
- **Password** - Secure password change
- **Two-factor authentication** - Authenticator app configuration

**What users cannot change:**
- **Username** - Login identifier (often email address)
- **Global user role** - Only Super Users can change roles
- **Object-level access** - Only Object Owners can assign object roles
- **Organisation settings** - System configuration is reserved for administrators

### Can a user change their own role?

**No, users cannot change their own global role** for security reasons and to ensure organisational control.

**Role change process:**
- **Only Super Users** can change global roles
- **Role change** happens from the person's Portal access field in Personnel
- **Immediate effect** - Changes are active immediately
- **Audit trail** - All role changes are logged

**Strict Mode object-level roles:**
- **Object Owners** can assign Viewer/Contributor roles
- **Users cannot** change their own object-level roles
- **Escalation** via Object Owner or Super User

### What happens to someone's data when access is revoked?

Revoking access removes the login, not the history. Every control, task, and piece of evidence they touched stays intact.

**Data integrity preserved when deleting users:**

**What remains:**
- **All compliance data** - Controls, assets, risks, tasks
- **Historical evidence** - Uploads and documentation
- **Audit trails** - Complete activity history
- **Tasks and assessments** - Completed and ongoing work

**What changes:**
- **The person stays in personnel** - Their record, groups and policy checks are untouched
- **Assignments** - Remain, but they can no longer respond to them
- **Notifications** - Stop, because there is no account to send them to
- **Access** - Blocked immediately

**Practical impact:**
- **Ongoing tasks** - Must be manually transferred
- **Ownership** - Assign new owners for continuity
- **Teamwork** - Colleagues must take over tasks
- **Reporting** - Historical contributions remain visible

### How does Strict Mode work versus normal mode?

Normal mode gives every Regular User access to all compliance objects; Strict Mode restricts that access to objects they're explicitly assigned to.

**Access control differences:**

**Normal mode (default):**
- **Regular Users** see all compliance objects
- **Global roles** determine what users can do
- **Open access** - All objects visible to all users
- **Simple rights** - Three roles for entire system

**Strict Mode (enhanced security):**
- **Zero-trust principle** - No access unless explicitly granted
- **Object-level roles** - Viewer, Executor, Assessor, Owner per object
- **Granular control** - Exact access per compliance object
- **Compartmentalization** - Users only see assigned objects

**When to choose Strict Mode:**
- **Large organisations** with many departments
- **Sensitive compliance data** requiring compartmentalization
- **Legal requirements** for data access control

## Common problems

### Someone cannot log in after their invitation

Start by checking whether the user is active, was actually invited, and received the email at the right address. All of this needs a Super User: the Access column and the Portal access field are theirs alone.

**Diagnosis and solution for login problems:**

**Check account status:**
1. **Verify on the People tab** - Is the person there, and does the Access column show a role?
2. **Check Portal access** - Is it still on No login?
3. **Confirm email receipt** - Did they receive the welcome email?
4. **Validate email address** - Is the address correct on their Details tab?

**Common causes:**
- **No login yet** - Portal access is still on No login
- **Invitation expired** - User didn't accept invitation within 7 days
- **Email not received** - Spam filter or wrong email address
- **Password not set** - User didn't complete Keycloak activation
- **Account timing** - Invitation can take several minutes

**Solution steps:**
1. **Resend the invitation** from the actions menu in the person's detail panel
2. **Check spam folder** of the person
3. **Verify email address** and correct if needed
4. **Guide password setup** via Keycloak interface
5. **Test login process** together with user

### Invitation email doesn't arrive

Check spam first, then the email address on file, then your organisation's own mail filtering.

**Email delivery problem solving:**

**Initial diagnosis:**
- **Check spam/junk folder** - Automatic filters can block email
- **Verify email address** - Typos on the person's Details tab
- **Check organisation firewall** - Email security can block Tidal emails
- **Validate email server** - Organisation email server problems

**Troubleshooting steps:**
1. **Correct email address** on the person's Details tab if needed
2. **Resend the invitation** from the actions menu in their detail panel
3. **Whitelist Tidal domains** in organisation email security
4. **Try alternative email address** for testing
5. **Contact IT support** for email server configuration

**Alternative solutions:**
- **Manual account setup** - Super User helps with password setup
- **IT escalation** - System administrator investigates email delivery

### Someone has the wrong access rights

Check their global role on the People tab and change it from the Portal access field if it is wrong.

**Access rights diagnosis and correction:**

**Check global role:**
1. **Go to Personnel** and open the person
2. **Verify current role** in the Access column
3. **Change the role if needed** from Portal access
4. **Test the new rights** with them

**Strict Mode specific check:**
- **Object-level roles** - Does user have correct Executor/Assessor/Owner role?
- **Object assignment** - Is user even assigned to relevant objects?
- **Active objects** - Are objects themselves active and available?
- **Inheritance** - Are rights correctly inherited from related objects?

**Solution per scenario:**
- **Too few rights** - Upgrade global role or add object-level roles
- **Too many rights** - Downgrade to appropriate role for function
- **Inconsistent access** - Review all object assignments systematically
- **Timing issues** - Wait several minutes after role changes

### Strict Mode access problems

**User sees no objects in Strict Mode:**

**Diagnosis steps:**
1. **Check global role** - Is user Regular User or higher?
2. **Verify object assignments** - Does user have object-level roles?
3. **Check object status** - Are objects themselves active?
4. **Check Strict Mode status** via green indicator

**Solution:**
- **Super User** assigns correct object-level roles
- **Object Owner** can grant access within own scope

**User cannot execute tasks:**

**Possible causes:**
- **Viewer role** instead of Contributor role
- **Object specific restrictions** set by owner
- **Task assignment** to wrong user

**Solution steps:**
1. **Verify object-level role** in object page
2. **Upgrade to Contributor** if needed
3. **Check task assignment** and deadline status
4. **Contact Object Owner** for role escalation

### Keycloak account problems

Most Keycloak issues are password resets gone wrong; the reset link goes out from the Keycloak login page, not from Tidal itself.

**Authentication and profile management issues:**

**Password reset problems:**
1. **Go to Keycloak login page** via Tidal Control
2. **Click "Forgot Password"** link
3. **Enter email address** and send reset
4. **Check email** including spam folder
5. **Follow reset instructions** in received email

### Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

> **info:**

**Gathering support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This significantly speeds up the solution.