How Accounts Are Created
Accounts arrive one of two ways: somebody registers themselves, or an administrator creates one for them. The choice shapes everything about who can reach your application.
Where to find it
Architect Panel → Configuration:
- Site Settings — the registration and welcome e-mail settings
Architect Panel → Security:
- Permissions — what a newly created account can reach
- User Verification — proving something about somebody before granting more
Self-registration
Anybody who can reach the page can create an account. Right for a public service, a customer portal, a marketplace — anywhere the population is open and you cannot know in advance who will arrive.
Administrator-created
Somebody inside the organisation creates the account. Right for staff systems and closed applications, where the population is known and membership is decided rather than claimed.
The question that actually matters
Not "should people register themselves" but what does a brand-new account get?
Self-registration is only safe if a new account can reach nothing sensitive. If registering gives somebody access to real data, then anybody in the world can have that access — and no amount of care in the registration form changes it.
Settle what a new account's permissions are before opening registration, and check by creating one and looking at what it can see.
Registration is not verification
Somebody who registers has demonstrated control of an e-mail address. They have not demonstrated who they are, that they work where they claim, or that they are entitled to anything.
Where those matter, that is user verification's job — and the useful pattern is to let people register freely into a low-privilege state and verify to gain more, rather than trying to police the registration form itself.
Expect abuse on an open form
A public registration form attracts automated sign-ups. Plan for it: rate limiting and account banning apply, and unverified accounts should be reaching nothing worth having.
A steady trickle of junk accounts that can see nothing is an annoyance. The same trickle with real access is an incident.
Both can coexist
Staff created by an administrator, customers registering themselves, with different default groups. That is usually the honest arrangement and it is worth setting up deliberately rather than forcing one model on both populations.
Think about leavers on both paths
Administrator-created accounts usually have a leaver process. Self-registered ones frequently do not, and accumulate indefinitely. Decide what happens to an account nobody has used for two years, because "nothing" is a decision you will have made by default.
Worked example
A membership organisation lets anybody register, which grants access only to public content and their own profile. Verifying membership through an e-mail domain check awards the Members group and the content behind it. Staff accounts are administrator-created. Registration abuse is visible and harmless, because an unverified account can reach nothing.
Recommendations
- Decide what a new account can reach before opening registration.
- Create one and look rather than assuming.
- Register freely, verify for access — do not police the form.
- Give self-registered accounts a lifecycle too.