You add people to your organisation by inviting them by e-mail. Each invitation carries a role. The person opens the link, signs in or creates an account with the invited address, and becomes a member. This page covers the roles, sending and managing invitations, and the two ready-made IoT groups.
Roles
Every member has exactly one role:
| Role | Can do (by default) |
|---|---|
| Owner | Everything, including managing administrators and other owners, signing keys for firmware, and raw device commands. An organisation always keeps at least one active owner. |
| Admin | Manage members, settings, devices, credentials, profiles, alarm rules, firmware, rules and shared dashboards; clear alarms; send privileged commands. |
| User | View devices, dashboards and alarms; acknowledge alarms; send basic commands; build personal dashboards. |
The default role of a new invitation is User. Give the smallest role that lets the person do their work, and add groups for anything extra (see below).
Invite a person
You need the Admin role or higher.
- Open Members (in the Organisation part of the menu).
- Select Invite Member.
- Enter the Email address and pick the Role.
- Select Send Invite. The page says Invitation sent.
Hermetry e-mails a link to the person. The link is valid for 7 days by default.
Rules:
- The Owner role is never granted by invitation. Ownership moves only by an ownership transfer; see Users and roles.
- Nobody can invite someone to a role at or above their own.
- You cannot invite someone who is already a member.
- A new invitation to the same address replaces the earlier pending one.
Follow and manage invitations
Open Invitations (address /admin/invitations) to see Pending Invitations with their Email, Role, Sent, Expires and Status (Pending, Accepted, Declined, Expired, Revoked).
| Action | Effect |
|---|---|
| Resend | Sends the e-mail again with a fresh link. |
| Revoke | “This immediately invalidates the invitation link. The recipient will no longer be able to accept it.” |
Invitation settings (on the same page) set two things for your organisation:
| Setting | Meaning |
|---|---|
| Invitation lifetime (days) | How long a new or resent link stays valid. It can only be shorter than the installation default (7 days). |
| Roles an invitation may grant | Any role the inviter may grant, or Members only (no admins by invitation). |
What the invited person does
- Open the link in the e-mail. The page says You’re invited and names the organisation and the role.
- Sign in, or create an account, with the invited e-mail address. The page reminds them: “If you’re not already signed in, you’ll be asked to sign in with address first.”
- Select Accept invitation (or Decline).
The page then says You’re now a member of organisation. The person can switch between organisations from the organisation picker.
If the person creates an account (or signs in with single sign-on) with the invited address and that address is verified, pending invitations to it are accepted automatically.
Change or remove a member
- Open Members and find the person (Search by email…).
- Use Edit to change the role or the status (Active, Inactive, Suspended), or Remove.
You cannot give someone a role equal to or above your own. Only owners can change or remove owners. The last owner cannot be demoted or removed. Some organisations require approval for role changes and removals; the page then says the change was submitted for approval, and the member keeps their access until it is approved.
Ready-made IoT groups
Groups add permissions on top of a member’s role. Two ready-made groups help with IoT teams:
| Group | Gives |
|---|---|
| IoT operator | “Watches and edits devices and writes their attributes. No device credentials, no creating or deleting devices.” |
| IoT viewer | “Sees every IoT page and list (devices, profiles, alarms, places, cameras, firmware, rules, certificates, LoRaWAN, endpoints, device settings) and is given no right to change anything. No credentials, keys, eSIM, panel sessions or settings pages.” |
To add one:
- Open the organisation Settings and then Access Control (address
/admin/settings/access-control). - On the Groups tab, choose the group in From template…. The page says Group added from template. Assign it to members on the Users tab.
- On the Users tab, add the members to the group.
The Access Rights tab shows the permission matrix: which role and which group holds which permission. See Groups and permissions.
Good practice
- Make sure at least two people hold the Admin role or higher, so work does not stop when one person is away. Before the owner leaves, transfer ownership.
- Give field technicians the User role plus IoT operator, not Admin: they can work on devices without seeing credentials.
- Give auditors and customers’ viewers User plus IoT viewer.
- Ask every member to turn on two-factor sign-in. See Two-factor sign-in and passkeys.
You are done
You have an organisation, a connected device, a dashboard, an alarm and a team. Before you put real devices into service, go through the Go-live checklist. To learn more about devices, continue with Devices.