Customers
The default persona
Everyone starts as a customer: sign-up, self-service and customer applications, with friction kept low.
Platform / Identity model
Identity Personas
Every person in WebFrolic is a customer, an employee or an administrator. Authenticators, applications, resources and other configuration can be assigned to one persona, several, or all of them, so each group gets the security and compliance rules that fit it.
Available now in WebFrolic.
Why it matters
One flat policy is too strict for customers and too loose for administrators.
Customers need low-friction sign-up. Employees need access tied to their job and their employment. Administrators can change everything. Treating them the same either frustrates customers or under-protects the platform, and it makes compliance evidence hard to produce.
Employees
Staff, by domain or group
People become employees through configured creation, an employee email domain or the employee group, and get workforce rules and the Employee Dashboard.
Administrators
The few who run the platform
Administrators configure the identity provider from the Administrator Dashboard, with the strongest sign-in and network requirements.
Scope by persona
Assign configuration to one persona or all of them.
Each of these can be limited to customers, employees, administrators, any combination, or everyone.
| Configuration | What scoping by persona does | Example |
|---|---|---|
| Authenticators | Controls which sign-in and recovery methods each persona may enroll and use. | Passkeys and security keys required for administrators; email OTP offered to customers. |
| Applications | Decides which applications appear for and may be opened by each persona. | An internal HR app for employees only; the customer portal for customers. |
| Resources and roles | Keeps permissions on protected resources inside the persona that should hold them. | Billing resources for administrators; order history for customers. |
| Profile attributes | Collects and validates different information for each persona. | Employee ID and cost center for staff; company name for customers. |
| Groups | Keeps membership rules from mixing customers and staff. | An “All staff” group populated from the employee domain. |
| Network and session rules | Applies stricter network ranges and session lengths where the risk is higher. | Administrators limited to office ranges with short sessions. |
| Dashboards | Gives each persona its own working surface. | Customers use the Customer Dashboard; staff also get the Employee Dashboard. |
Personas and dashboards
Each persona has a place to work.
In the console
Set it up in four steps.
Menu names match the WebFrolic console. The setup guide has the detail.
Decide who is an employee
In Configuration → Email Settings → Employee Domains, list the domains whose sign-ups become employees, or use the employee group.
Scope authenticators
In Authenticators, choose which personas may use each method for sign-in and for recovery.
Scope applications and resources
Assign applications, resources and roles to the persona that should reach them.
Check each persona
Sign in as a test customer, employee and administrator and confirm each sees only its own methods, applications and dashboard.
Before rollout
Questions worth answering.
Settle these first and the rollout is mostly configuration.
- Write down which persona each kind of person belongs to, including contractors and partners.
- Decide what happens when a customer becomes an employee, and the reverse.
- Choose the authenticators each persona may use, and which may be used for recovery.
- List applications and resources that must never be visible to customers.
- Agree how administrator status is granted and reviewed.
Related capabilities
Explore what connects to this.
These capabilities are usually configured together.
Evaluate with your scenario
Start with a concrete workflow.
Share the identities, resource boundary and decision you want to test. The walkthrough can focus on the relevant behavior rather than a generic feature tour.