Login & access workflows

Every customer user starts at https://www.rebelcore.ai/login. The account type and assigned role determine the verification method, destination, and available navigation.

1

Sign in Open www.rebelcore.ai/login and enter your email and password.

↓

2

RebelCore resolves your destination Your governance account or assigned role decides the app and second factor.

Agent-only role Access Agent is on and every portal permission is off

↓

Second factor Email one-time code

↓

Landing Customer Agent Agent only; no portal return link

Portal role One or more portal permissions are on

↓

Second factor Authenticator code (TOTP)

↓

Landing Customer portal Pages and actions follow the role flags

Governance account Customer Super Admin, DPO, or Security Officer

↓

Second factor Authenticator code (TOTP)

↓

Landing Customer portal Governance surfaces follow the account type

No portal permissions and no Agent access Sign-in is refused because the account has no application destination.

Separate global path CAS account → cas.rebelcore.ai → Authenticator code → CAS administration

Account flows

Account or role	Landing page	Verification	Access
Customer Super Admin	Customer portal	Authenticator app	Customer workspace, administration, governance, Audit, Activity, Customer Settings, and Agent.
Data Protection Officer	Customer portal	Authenticator app	Assigned governance areas, including HITL, Data Residency, Compliance, and Login Activity.
Security Officer	Customer portal	Authenticator app	Assigned governance areas, including HITL, Data Residency, Compliance, and Login Activity.
RebelCore_SuperUser	Customer portal	Authenticator app	Portal and Agent actions enabled by the system role. Customer-owner-only areas remain unavailable.
RebelCore_User	Customer portal	Authenticator app	Standard dataset, project, Tree, and Agent access.
RebelCore_AgentUser	RebelCore Agent	Email one-time code	Agent only, with no portal return link.
Custom role	Portal or Agent	Authenticator app for portal access; email code for Agent-only access	Exactly the features enabled on the role.
CAS user	CAS	Authenticator app	Platform provisioning and administration, separate from customer roles.

An account with no portal permissions and no Access Agent permission cannot enter an application. Ask an administrator to assign an appropriate role.

Permission-to-area map

Permission or account type	Available area or action
View Datasets	Datasets navigation and dataset list.
Add Datasets	Import and upload actions.
Add Module	Module curation and build actions.
Add Projects	Project creation and editing.
View Tree	Project and Tree navigation.
Create Semantic Dataset	Semantic dataset build action.
Delete Semantic Dataset	Semantic dataset deletion action.
Access Agent	RebelCore Agent and authorised Agent launch buttons.
Add Users	User administration.
Add Roles	Role administration.
Customer Super Admin, DPO, or Security Officer	Governance areas associated with that responsibility.
Customer Super Admin only	Audit, Activity, and Customer Settings.

The portal Home page is available to accounts routed to the portal. After an administrator changes a role, refresh the page to update the visible navigation and actions.

Agent-only workflow

Agent-only users have the shortest route:

1. Open the standard RebelCore sign-in page.
2. Enter the account email and password.
3. Enter the one-time code sent by email.
4. Continue directly to RebelCore Agent.

The Agent-only interface does not show a link back to the customer portal because the role has no portal access.

First sign-in and recovery

New users set their password from the invitation email. Portal users then enrol an authenticator and receive backup codes. Agent-only users use an email code instead.

For expired invitations, lockouts, password resets, backup codes, and sign-out, see Signing in. To change access, see Roles & permissions.