Remote Manual · Authorization

Users, roles and permissions

Start with a human identity, select its role baseline and add narrowly scoped permission assignments only where needed.

Remote manual Access model Users Roles Permissions Evaluation Procedure Role reference Troubleshooting

Effective Access

Permission allows the operation, policy narrows where

Create the identity

Human users authenticate by email and belong to one tenant in the current model.

Assign a role

The role supplies the normal tenant, site or PLC-scoped permission baseline.

Add exceptions

Direct user assignments can grant additional access. They do not subtract access already granted through the role.

For register operations the PLC’s command policy is evaluated after permission. A permission can make an operation available while the policy still restricts the register family, operation or address range.

Users

Manage human identities and their role membership

Users catalog

Review identity, role, status and administrative scope.
Use real tenant role records rather than a free-form role label.
Keep reserved system roles out of human-user selection.
Deactivate or archive identities that must no longer sign in.

Filter users

Find identities by visible account attributes.

Create user

Add a tenant user and choose its role.

Edit user

Update identity, status or role membership.

Archive user

Confirm removal from active administration.

Roles

Define reusable tenant access baselines

Roles are tenant-owned templates. Cloning a role copies its active permission assignments and scope targets.

Roles catalog

Use Viewer, Operator, Controller and Tenant admin templates as starting points.
Create or clone a role when responsibilities need a distinct reusable baseline.
Reassign active users before archiving their role.
Archived roles remain in history but stop contributing permissions.

Filter roles

Find a template or tenant-defined role.

Create role

Define a named responsibility baseline.

Edit role

Update the role’s descriptive metadata.

Archive role

Confirm archive after active users are reassigned.

Permission Assignments

Grant an operation to the smallest useful scope

Permission assignments

Select a role for reusable access or a user for a narrow exception.
Choose tenant, site or PLC scope.
Verify the scope target before saving.
Remember that direct grants add to role access rather than denying it.

Filter assignments

Trace grants by permission, principal, type or scope.

Create assignment

Grant one permission at a defined scope.

Edit assignment

Correct its principal or scope target.

Archive assignment

Remove this grant from effective access.

Evaluation Order

Follow the complete access decision

Gate	Question	Important behavior
Identity and tenant	Is the authenticated user active in the tenant that owns the target?	One human identity belongs to one tenant in the current model.
Visibility	Does an applicable role or direct-user assignment make the PLC visible?	Hidden resources cannot be operated by guessing their IDs.
Operation permission	Is test, status, read, write, control, run or stop granted at tenant, site or PLC scope?	Assignments are additive. A narrower assignment cannot deny a broader one.
Command policy	For register operations, does the PLC policy allow the family, operation and every requested address?	A policy only narrows access. It never creates permission.
Request validation	Are values, request size, register family and address step valid?	Backend validation remains authoritative even when the browser checked first.

Procedure

Build reusable access before adding exceptions

Steps

Identify a job responsibility, not a person and select or create the role that represents it.
Assign the role its baseline permissions at the smallest practical scope.
Create the user with email, full name, optional phone, active state and the persisted role.
Add a user-scoped assignment only when that person needs access beyond the role baseline.
For register operations, verify the target PLC has the intended command policy.
Test with the affected user context and confirm visible PLCs plus available operations.
Review audit history for the permission change and subsequent allowed or denied operation.

Direct grants are exceptions, not overrides. They add access to the role baseline. To remove access, change or archive the assignment that grants it; do not expect a narrower assignment to subtract permission.

Role Guidance

Use starter roles as templates, not hard-coded categories

Starter role	Typical baseline	Review before assigning
Viewer	Visible PLCs, connection test, status and permitted register reads.	Whether read access is tenant-, site- or PLC-scoped and whether policy ranges are appropriate.
Operator	Viewer capabilities plus allowed register writes.	Write families, ranges and whether control-style writes are excluded.
Controller	Operator capabilities plus run and stop where granted.	Operational responsibility and the exact PLC scope.
Tenant admin	Tenant catalog administration plus operational permissions.	Preserve at least one active administrative path before removing admin grants.
System Monitoring	Reserved machine-identity observability access.	Do not offer this role in human-user pickers.

Clone

Use clone when a new responsibility mostly matches an existing role. Active permission assignments and their targets are copied into the new role for explicit review.

Explain unexpected access from the grants that produce it

User sees too much

Search both role and direct-user assignments. A tenant-scoped grant can authorize resources beyond narrower site or PLC assignments.

User sees too little

Verify device.view first, then the requested operation permission and its scope. For register operations, inspect the PLC policy afterward.

Role cannot be archived

Find active users assigned to the role and move them to a replacement role or deactivate them before retrying.

Permission change appears ineffective

Confirm the correct principal, scope type and scope target. Then check whether another additive assignment still grants the same permission.