Websites · Glossary
What is an admin role?
An admin role is a set of permissions given to the people who manage a website or app, such as editing listings, confirming bookings or seeing every order. In role based access control, permissions attach to roles and people are assigned roles. On a well built site the role is checked by the server or database, not just by hiding buttons.
Hiding the Admin menu from most people is not security. The role matters only if every request to change data is checked against it where the data lives.
Nuwan Madhusanka · Co-founder
4 min read · Published
| Who | Typically can | Typically cannot |
|---|---|---|
| Visitor (not signed in) | Read public pages, submit a form or booking request | See anyone's personal data, change listings |
| Signed in member | See and edit their own profile, bookings and orders | See other members' data, change prices |
| Admin | Manage listings, confirm bookings, see all orders, export data, add other admins | Bypass the payment provider or read card numbers |
What it is
Role based access control, which NIST defines as access control based on user roles, groups permissions under named roles such as admin, staff and member, and assigns people to roles instead of granting permissions one by one. An admin role is the most powerful role on a small site. What it can do depends on the site: on a shop it might add products and mark orders shipped; on a club site it might approve members and post notices. Large systems split admin into finer roles; small business sites usually need one admin role plus ordinary signed in people.
How it is enforced
The admin role is stored somewhere the site trusts: a table of admins, a column on the profile, or a claim in the sign in token. Every request that changes or reads protected data checks it. In a Postgres database with row level security, policies on each table can say, for example, that anyone may insert a booking request, a member may read only their own bookings, and only people in the admins table may read all of them or change their status. Because the check runs in the database, it holds even if someone calls the API directly and skips the website's menus.
When it matters
As soon as a site holds data from customers: bookings, orders, messages, applications or member details. Broken access control tops the OWASP Top 10 list of web application security risks, and the usual cause is an admin page protected only by being hidden. It also matters when staff change: removing a former employee's admin role must take effect at once, and no shared admin password should exist that lets them back in.
Common mistakes
Checking the role only in the browser, so anyone who finds the API can act as an admin. Sharing one admin login between staff. Making the first person who signs up an admin automatically. Granting admin to everyone at a business because it is simpler. Forgetting to protect exports, which often reveal more than the screens. Storing the role in a place the person can edit, such as their own profile row. And never reviewing who still holds the role.
Where it shows up in OneCraft
With the admin capability guide, a OneCraft site gets a site_admins table and an /admin area, or an Admin tab in an app, shown only to admins. The agent creates the first admin from the owner's contact email. Every table must have row level security, and before a generation step can finish the agent checks each new table as an anonymous visitor and as a signed in person, and as an admin, with its check_access tool.
Questions people ask
How many admins should a small business website have?
As few as can cover holidays and sick days, usually two. Each admin should have their own sign in, so actions can be traced and access removed individually. Staff who only need to confirm bookings or reply to messages may not need full admin rights if the site offers a narrower role.
What is the difference between an admin and an owner?
On many platforms the owner holds the account, billing and the right to delete the site, while admins manage content and data inside it. An owner can usually add and remove admins. On a simple site the owner is often also the first admin.
Is hiding the admin page enough to protect it?
No. Hidden pages and buttons only change what the menu shows. Anyone who knows or guesses the address, or calls the API directly, reaches the data unless the server or database checks the role on every request. Enforce the role where the data is stored.
Can an admin see customers' card details?
On a site that uses a payment provider such as Stripe Checkout, no. Card details are entered on the provider's page and never reach the site's database. Admins see orders, amounts and payment status, while refunds and disputes are handled in the provider's dashboard.
How do I remove someone's admin access?
Remove them from the admin list or role in the site's database, and end their active sessions if the system allows it. If admin rights are read from a sign in token, they may last until the token expires, so check how long tokens live and whether the system rechecks the role.
Make one with websites
The button opens the generator with this use case already described. Change the wording to match your own.
Create a website with OneCraftRelated questions
- What is a magic link?What is a magic link? A one time sign in link sent by email instead of a password: how it works, how long it lasts, and how it compares with passwords.
- What is OAuth?What is OAuth? The framework behind Sign in with Google: the four roles, how the code flow works, how OpenID Connect adds identity, and common mistakes.
- What is row level security?What is row level security? Database policies that decide which rows each signed in person can read or change, with common policy shapes and how to test them.
- What is seed data?What is seed data? Rows inserted into a new database so it has something to show and test: seed data compared with fixtures, reference and production data.
Written and checked by the OneCraft team. Last checked .