Manage users & roles

This guide covers the core admin flow: inviting a user to a project and giving them the right roles, which control what they can do in MaxTrax.

Before you start

You need a Corporate Administrator role or higher.

Invite a user

Open Users from the admin navigation, then select New user.
Enter the user name and email (both required — email is how the new user redeems their invite). Display name is optional.
Check the roles to grant (see Understanding roles below) — you can leave this blank and set roles later.
Choose project scope: leave All projects checked, or uncheck it and select one or more projects by name from your authorized list.
Select Create & invite.

MaxTrax shows a one-time invite token right after creation, with a clear warning that it’s shown once and can’t be retrieved again. There’s a Copy token button, and below it a ready-to-use redeem link with its own Copy link button — send either one to the new user through your own out-of-band channel (chat, in person, and so on); the link just saves them a step. Select Done once you’ve saved it — it won’t be shown again.

The new user sets their password

The invited user opens the link you sent them, which takes them to a Set your password page. They enter and confirm a new password and submit — MaxTrax confirms their password is set and tells them to sign in with the username your admin panel showed you. If the link has already been used, or has expired, the page tells them to ask you for a new invite.

The role ladder

At the top of the Users list is the role ladder — the seven MaxTrax roles in order, most powerful first, each showing how many people hold it.

The counts are for your whole organization, not the page you’re looking at. Turning to page 2 never changes them.
Select a rung to filter the list to that role. Select it again to clear the filter. The filtered view has its own web address, so you can bookmark it or paste it to a colleague and they see the same list.
Someone with two roles is counted on both rungs. That’s deliberate — a rung answers “who holds this authority”, and people can hold more than one. It also means the rung counts add up to more than your number of users, so don’t read the total as a headcount.

Understanding roles

The Roles you check on a user are the actual permissions MaxTrax enforces. They describe what a person can do — broader than the four task guides in this help center (inspector, NDT technician, welder, admin). Roles are cumulative (each role includes everything the roles below it can do), so most users need just one; a user can hold more than one, and their most powerful role wins.

Reader — view-only access, no changes.
NDE Inspector — records inspection and NDT results (the tasks in Record an inspection result and Record a film interval result).
Weld Associate — day-to-day weld data entry: create and update welds, complete welds, and everything a Reader and NDE Inspector can do.
Project Associate — broader project-level access for coordination roles (engineering, document control).
Project Administrator — administers a single project’s setup.
Corporate Administrator — full administrative access across projects: users, roles, project and global settings, custom fields and reports, and the audit log. Managing users and roles needs this role or higher.
System Administrator — reserved for CSDS operator use; you won’t normally assign this to a project user.

For the full picture — a capability matrix of exactly what each role can do, and how roles combine with project scope — see Roles & capabilities.

If someone tries to reach a screen their roles don’t cover, MaxTrax shows an Access required message naming what’s needed (for example, “You need a Corporate Administrator role or higher to manage users”).

Scopes: what a user’s access is limited to

Roles say what someone can do. Scopes say which things they can do it to. The Users list shows both: a Project scope column, and an Other scopes column with a chip per dimension.

There are seven scoping dimensions in total:

Projects — the shipped project scope, edited in its own section.
Contractor, NDE contractor, Inspection type, Weld type — editable in the Other scopes section of the edit drawer.
Approval group — shown, but read-only for now: there is no approval-group list to pick from yet, so MaxTrax shows the current value rather than a control that wouldn’t work.
Facility — its own section, covered under Grant facility party-admin below.

Reading the chips:

A chip lists the named items a user is limited to (for example, Contractor: Saulsbury).
All means the user is not limited on that dimension.
unknown means MaxTrax could not read that dimension’s stored value. It is deliberately not shown as “All” — an unreadable setting is not the same as unrestricted access, and MaxTrax will not guess in the direction of more access.
(partial) means some entries were left out because they’re outside your own scope. You are seeing a subset, and MaxTrax says so rather than showing you a list that looks complete.
No other scopes means the user has no limits set on any of these dimensions.

Confirming a change that removes all-access

If a dimension is currently set to All and you save a specific list instead, MaxTrax asks you to confirm first. The confirmation names each dimension you’re narrowing and how many items will still have access.

It also warns that if your own access on that dimension is limited, you won’t be able to put it back to all-access — because restoring it would mean granting access you don’t hold yourself. Whether that applies depends on your own account, which is why it’s worded as a condition.

Select Confirm and save to go ahead, or Cancel to leave things as they are.

Change or remove access

On the Users list, each row’s Manage menu offers:

Edit roles & scope — opens a drawer with independent sections — Roles, Project scope and Other scopes — where Roles saves on its own and the two scope sections save together. Changes take effect the next time that user signs in.
Lock / Unlock — locking blocks sign-in without changing roles or scope.
Deactivate / Reactivate — deactivating removes the user from active use; reactivating restores it.
Set password… — sets a new password for the user (see Set or reset a user’s password). It isn’t shown on your own row.

If a scope change is refused (for example, because it would grant access you don’t hold yourself), the drawer stays open and shows why, with a Retry button — nothing is saved, and MaxTrax never reports a success it didn’t get.

Set or reset a user’s password

When someone can’t sign in — a welder or inspector who has forgotten their password, for example — you can set a new one for them.

On the Users list, open the row’s Manage menu and select Set password….
Enter the new password in New password and again in Confirm password. Use Show passwords to check what you typed.
Select Set password.

MaxTrax confirms with Password set. They have been signed out everywhere. The user is signed out of every device, and their next sign-in uses the new password straight away — even if they were briefly held back for too many wrong guesses. Give them the new password through a channel you trust (in person, or a call); MaxTrax never shows it again, and the user isn’t asked to change it at their next sign-in.

If the password doesn’t meet the password policy, the dialog stays open and lists every rule it breaks. A password that matches the user’s current one is refused too.

Some things to know:

Locked accounts stay locked. Setting a password doesn’t unlock an account — use Unlock as well. The dialog reminds you when the account is locked.
Who you can reset. You can set the password of a user whose role is below yours. You can’t set the password of another administrator at your level or above, or the tenant’s break-glass account. To change your own password, use Change your password, which asks for your current password.
No password to reset. An invited user who hasn’t set their password yet, or someone who signs in only through your organization’s single sign-on, has no MaxTrax password — the dialog says so. For an invite, ask them to use their invite link.
Recorded in the audit log. Every password set is recorded as set_password, with who did it and when — never the password itself.
Already-open screens. A device that was signed in can keep working for up to about 15 minutes before it’s asked to sign in again.

Grant facility party-admin

A facility party-admin administers a facility — its projects’ administrative metadata and, in time, who else administers it. You grant and revoke this seat from the same Edit roles & scope drawer, in its Facility party-admin section.

You can only grant facilities you administer yourself. The facility picker lists exactly those facilities — if you administer none, the control is disabled and says so. This is deliberate: you can never hand someone authority over a facility you don’t hold yourself.
To grant: pick a facility and select Grant. The user gains the facility party-admin seat for that facility.
To revoke: select Revoke next to a facility in the user’s current list, then Confirm — revoke removes administrative authority, so it asks first.

A facility party-admin seat is enforced only inside the admin surface; it never changes what the user can do in day-to-day project work. Every grant and revoke is recorded in the audit log.

Two-factor authentication for administrators

Your organization can require every administrator to use two-factor authentication. When that requirement is on, an administrator who signs in with a MaxTrax password and hasn’t set up an authenticator app yet doesn’t reach MaxTrax at all — they land on Set up two-factor authentication and can go no further until they finish it.

The administrator completes the setup themselves, in that same sign-in — no one has to unlock anything for them:

Scan the code shown with an authenticator app, or use Or enter this key manually.
Type the app’s 6-digit code into Authenticator code and select Verify and finish.
On Save your recovery codes, select Copy codes or Download .txt, select I have saved my recovery codes, then select Continue. The codes can’t be shown again, and Continue stays unavailable until you select that checkbox.

From the next sign-in on, that administrator is asked for their authenticator code as normal.

If setup is interrupted before step 2 finishes, nothing is lost — sign in again and it restarts.

This requirement applies to administrators who sign in with a MaxTrax password. If your organization signs in through its own identity provider (single sign-on), two-factor authentication for those accounts is governed by that provider’s policy, not by this setting.

The requirement is a per-organization setting and is off unless it has been turned on for you — it isn’t something you switch on from inside MaxTrax. Ask your MaxTrax contact to enable it.

Turn it on before administrator passwords are at risk. Until an administrator has set up their authenticator, their MaxTrax password on its own is what authorizes that first setup — so the requirement protects an account fully from the moment that administrator completes step 2, not from the moment the setting is switched on. If you believe a password has been exposed, change it first.

Keep access aligned

Roles and scopes are how MaxTrax keeps each person’s access focused on what their job needs. The role ladder is a quick way to review this: select a rung and check that everyone holding that authority still needs it.

Roles & capabilities — what each role can do, in full.
Admin overview
Welder qualifications settings
Getting started — roles and vocabulary.