Skip to main content
Managing access one person at a time gets unwieldy as your security team grows. Admin Groups solve this by letting you create named collections of users — say, “Triage Team” or “Frontend Engineers” — and assign roles to the group as a whole. When you add someone to a group, they immediately inherit every permission that group holds. When you remove them, those permissions are revoked at the same time. You never have to track down a dozen individual role assignments just to offboard someone.

​
What Admin Groups Are

An Admin Group is a reusable container that belongs to your organization. It has a name, an optional description, and a list of members. You can then assign the group one or more roles at any scope — organization, program, Business Unit, or individual report. When Hackrate evaluates a user’s access, it expands their group memberships and combines them with any direct assignments, always applying the most privileged role that results. Groups are visible from your organization management page alongside Business Units, programs, and individual user rights.

​
Creating a Group

1

Open Organization Management

From your organization dashboard, click Organization Management (or your organization name in the top navigation). You need a SuperAdmin role at the organization level to manage groups.
2

Navigate to Admin Groups

Scroll to the Admin Groups section. You’ll see a list of existing groups and an option to create a new one.
3

Name and describe the group

Give the group a clear, purpose-driven name (e.g., “Triage Team”, “Security Researchers”, “Frontend Team”). Add an optional description so other admins understand who belongs here.
4

Save the group

Click Create. The group is now available to receive members and role assignments.

​
Adding Members to a Group

1

Select the group

From the Admin Groups list, click the group you want to manage.
2

Invite members

Click Add member and enter the email address of the person you want to add. If they already have a Hackrate account, they are added immediately. If not, they receive an invitation email.
3

Confirm membership

The user appears in the group’s member list. Pending invitations are shown separately until the invitee registers.
A user can belong to multiple groups. Their effective role at any scope is always the most privileged role they hold, whether it comes from a direct assignment or any of their groups.

​
Assigning a Role to a Group

You can assign a group a role at any of the four scope levels — organization, program, Business Unit, or report. The assignment works exactly the same way as assigning a role to an individual user.
Assign the group a role at the organization level to give every member access across all programs. This is appropriate for a core security team that triages reports from multiple programs.From the organization management page, find the User Rights section, choose Add right, select the group instead of an individual user, pick the role, and set the scope to the organization.

​
Worked Example: Creating a Triage Team

1

Create the group

Create a new group named Triage Team with the description “First-line reviewers for all inbound reports.”
2

Add your triagers

Invite the three engineers responsible for first-pass triage. They receive email invitations.
3

Assign a role at program level

Once the group is created, assign it the StandardAdmin role scoped to your main bug bounty program. This gives every member triage access to that program’s reports.
4

Add future members as needed

When a new engineer joins the triage rotation, add them to the group. They immediately inherit StandardAdmin access — no extra role assignment required.
If a user is both a member of the Triage Team group (which has StandardAdmin at program level) and has a separate direct assignment of Read-Only at the organization level, Hackrate evaluates all of their rights together and applies the most privileged one. In this case, they would have StandardAdmin on the specific program and Read-Only everywhere else.Group membership never reduces access — it can only add to it.
Removing a user from a group revokes the rights that came from that group. If the user also has direct assignments, those remain. Always review a user’s direct rights before assuming removal from a group fully revokes their access.