Core concepts
Access control
Role, capability, exact-action and Site/Group scope enforcement.
Authorization layers
- Role: built-in or administrator-defined Custom Role.
- Capability: whether a workspace or class of operation is accessible.
- Exact action policy: which catalog change actions are allowed for constrained roles.
- Scope: global access or assigned Sites and Groups.
Built-in roles
| Role | Scope | Purpose | Operational authority |
|---|---|---|---|
| Administrator | Global | Full platform, inventory and network access everywhere. | All capabilities and all actions |
| Power User | Global | Full switch operations and raw CLI access across the fleet, without platform administration. | All operational actions, terminal and custom CLI |
| Site Administrator | Scoped | Full governed operational access, restricted to assigned Sites and Groups. | All operational actions inside scope |
| Operator | Scoped | Operational troubleshooting, governed changes and approved Runbooks inside assigned scope. | Read actions, alias, interface/PoE cycle, PoE enable/disable, Fix UNP, VLAN maintenance, save configuration, approved Runbooks |
| Helpdesk | Scoped | Scoped visibility and basic port support. | Read actions, alias, interface restart and PoE restart |
| Read Only | Scoped | Scoped inventory and activity visibility only. | No live CLI execution or console access |
New/fresh scoped SSH users fail closed until an Administrator assigns All Sites or one or more Sites/Groups.
Backend enforcement
Scope is enforced by server APIs across Switches, Find Device, Operations, Audits, Jobs and live diagnostics. Hiding a menu item in the UI is not the authorization boundary.
Source-backed detail
How authorization is evaluated
Every protected operation combines role capabilities with Site/Group scope. Navigation visibility is only a convenience; backend dependencies enforce the effective permission again for every request.
Built-in roles provide stable baselines. Custom roles hold exact capabilities without granting global scope. Power operations separate view, add, edit, delete, verify and assignment rights.
Design guidance
- Start with the narrowest suitable built-in role.
- Use custom roles for responsibilities, not individual exceptions.
- Grant organizational scope separately from functional capability.
- Review effective access after reorganizing Sites or Groups.