↓ Skip to main content
TantoC2 Documentation
  1. Documentation/
  2. Architecture/

RBAC

Table of Contents
TantoC2 implements a four-tier role-based access control system with dynamic collector grants.

Roles
#

RoleDescription
AdminFull system access. Manages users, engagements, and system configuration. Implicit access to all engagements.
OperatorManages agents, executes modules, manages listeners, builds agents, manages credentials. Requires per-engagement access grants.
SpectatorRead-only access. Views agents, results, credentials, audit logs, and listeners. Cannot execute any actions.
CollectorSame baseline as Spectator. Can receive dynamic, time-limited grants for specific actions scoped to specific agents.

Permissions Matrix
#

CapabilityAdminOperatorSpectatorCollector
Manage usersYes———
Manage engagementsYes———
Manage system configYes———
Manage agentsYesYes—Grant
Execute modulesYesYes—Grant
Manage listenersYesYes——
Build agentsYesYes——
Manage credentialsYesYes——
View agentsYesYesYesYes
View resultsYesYesYesYes
View credentialsYesYesYesYes
View audit logYesYesYesYes
View listenersYesYesYesYes
Grant collector permsYesYes——

“Grant” indicates the capability is available only when a dynamic grant has been issued.

Engagement-Scoped Access
#

Non-admin operators must be explicitly granted access to each engagement:

1
2

POST /api/v1/operators/<id>/grant-access
{"engagement_id": "<engagement_id>"}

Admins have implicit access to all engagements.

Collector Dynamic Grants
#

Collectors can receive temporary, scoped permissions from Operators or Admins:

1
2
3
4
5
6
7

POST /api/v1/collectors/grants
{
  "collector_id": "<collector_id>",
  "permission": "manage_agents",
  "agent_ids": ["<agent-id-1>", "<agent-id-2>"],
  "expires_at": "2026-04-01T00:00:00Z"
}

Grants can be:

  • Agent-scoped: Limited to specific agents (agent_ids list) or all agents (agent_ids: null)
  • Time-limited: Expires at a specific time (expires_at) or permanent (expires_at: null)

Revoke a grant:

1

DELETE /api/v1/collectors/grants/<grant_id>

Web UI Behavior
#

The web UI adapts based on role:

  • Spectators: Action buttons (create, execute, start, stop, kill) are hidden or disabled
  • Collectors: Same as spectators, plus any dynamically granted actions
  • Operators: Full action controls for granted engagements
  • Admins: Everything, including Admin and Engagements management pages

Protection Rules
#

  • The last admin cannot be demoted, deactivated, or deleted
  • Force-logout invalidates all tokens for an operator immediately
  • All actions are logged in the audit log with role and principal attribution