Account
Team roles
The five roles, what each can and cannot do, how members are invited, and why nobody creates an account by signing up.
Last revised
Access in MapProtector is by permission, and permissions come from a role on a membership. The roles are ordered so that the acts whose consequences reach a third party — activating a price floor, sealing evidence, approving and sending a notice — sit with the role that owns the workspace, and the day-to-day work sits below it.
The roles
| Role | In one sentence |
|---|---|
| Brand Admin | Runs the workspace: billing, members, brands, policies, sealing, approving and sending. |
| Compliance Manager | Owns the compliance posture: promotions and exceptions, monitoring, seller classification, review decisions, evidence requests, preparing notices. |
| Analyst | Works the catalog and the queues day to day. Sees everything; does not sign a decision. |
| Legal Reviewer | Reads everything and downloads evidence. Changes nothing. |
| Viewer | Read-only. |
What each role can do
| Action | Viewer | Legal Reviewer | Analyst | Compliance Manager | Brand Admin |
|---|---|---|---|---|---|
| Read products, observations, sellers, candidates, cases, evidence, notices | ✓ | ✓ | ✓ | ✓ | ✓ |
| Add and import products; run a scan now | ✓ | ✓ | ✓ | ||
| Archive a product; configure monitoring | ✓ | ✓ | |||
| Create a MAP policy; append or end a version | ✓ | ||||
| Draft a promotion; create or revoke an exception | ✓ | ✓ | |||
| Approve a promotion | ✓ | ||||
| Classify a seller | ✓ | ✓ | |||
| Confirm or dismiss a candidate | ✓ | ✓ | |||
| Request evidence; verify integrity | ✓ | ✓ | |||
| Download evidence | ✓ | ✓ | ✓ | ✓ | ✓ |
| Seal evidence | ✓ | ||||
| Prepare a notice; configure sequences | ✓ | ✓ | |||
| Manage templates and the sender identity | ✓ | ||||
| Approve and send a notice | ✓ | ||||
| Invite members and change roles; billing | ✓ |
Inviting a member
- Open Workspace › Team and choose Invite a member (Brand Admin).
- Enter the address and choose the role. The invitation is sent by email with a single-use link that expires in seven days and can be revoked from the same page at any time.
- The recipient opens the link, sets a name and a password (twelve characters or more, including a symbol), and joins. If the role requires a second factor, they enroll one before the workspace opens.
- The Team page lists members with their status (active, invited, revoked) and whether their second factor is enrolled.
No sign-up
Nobody creates a MapProtector account by typing an address into a form. A workspace is created by MapProtector for your organization and its first Brand Admin is invited by email; Brand Admins invite everyone else. A product that can email sellers in your name does not hand out accounts to anybody with a browser.
Second factors and Amazon data
Brand Admins must enroll a second factor. Any member who reads Amazon-sourced data — observations, sellers, candidates — must also enroll one before that data is shown to them; the Team page says This member cannot reach Amazon data until they enrol a second factor. See Two-factor authentication.