2.0.1 is out today. Kuray and Sema are posting about the sign-in and dashboard changes, so I’ll take the two that are about how you organise people.
Custom access groups. Next to the built-in roles you can now create your own groups and put people in them. A group adds permissions on top of a member’s role. A typical case is a field technician who should work on devices but stay a User: make a group for that job and add the technicians to it, instead of making them Admins. Groups also show up as their own columns in the Access Rights matrix. How it works: Groups and permissions.
Workspace rename. An organisation admin can now rename the organisation’s workspace. See Organisation settings.
Questions about either one, post them here.
Can a group take a permission away? We have Users who should see devices and alarms but never acknowledge anything.
No, groups only add. A member’s rights are the role plus every active group, and nothing in a group subtracts.
To hold someone back from what their role allows, use an access policy with a deny. A deny always wins over the matrix. Policies need the Owner role to set up: Access policies. If it’s a whole role you want changed (no User in your organisation may acknowledge), unticking that cell for User in the Access Rights matrix is simpler.
The rename is welcome. Two of our customer workspaces still had “trial” in the name and we kept having to explain it on calls.
If I put a User in a group that has raw commands ticked, can they send raw commands then? Asking before someone tries it on a live line.
They can’t. A group can lift a member over an Admin minimum, never over an Owner one. Raw commands, ownership transfer and deleting the organisation stay with owners whatever a group says, and those cells are locked in the matrix for everyone but the owner.
One thing we learned the slow way: the group key can’t be changed after you create it. The key is what shows in the audit log and in policy conditions, so we went with plant.north.operators style keys and kept the friendly names in the label.
- You must be logged in to reply to this topic.
Join the conversation
Sign in to ask and answer, like helpful posts and mark the reply that solved your problem. Every contribution earns points and levels.