Roles and permissions

A user of Nexus Telemetry Fleet has one of 4 roles: Owner, Admin, Operator or Viewer. Each role has a fixed set of the 6 permissions below. Owner and Admin differ only in billing, which has no interface yet, and in the sign-in policy: with Password set to Owners only, an Owner signs in with a password and an Admin signs in with Microsoft. See Users and roles for adding users and setting their roles.

Permission matrix

Permission Allows Owner Admin Operator Viewer
View Reading the dashboard, a terminal’s page, the Certificates page and the Settings page yes yes yes yes
Terminal actions Every action on one terminal: rename, update, reboot, speed test, acknowledge and silence its alerts, set its location, rotate or revoke its certificate, decommission it, remove its record, and re-admit it. See Retire and revoke yes yes yes no
Manage certificates and tokens Generating and revoking enrolment tokens, rotating the CA certificate and the Fleet Server Certificate, and the actions on the root key. See Best practice yes yes no no
Manage groups and organisation settings Creating and changing groups, alerts, group maintenance windows, connectivity check targets and fleet-wide settings, and opening the availability report and the audit trail yes yes no no
Manage users Adding, changing and deleting users, and creating organisations yes yes no no
Billing Nothing yet. The permission exists for billing, which has no interface yes no no no

A role the fleet server does not recognise is treated as Viewer.

Conditions that override the matrix

Condition Effect
The user is not in the platform organisation, the one that manages the fleet server The user cannot change fleet-wide settings, the Fleet Server Certificate or the fleet server’s own root key, and cannot open Server health, Licence or Operator Audit, whatever the role. See Organisations
The user has group access set The user sees only the terminals in those groups, whatever the role. A terminal in no group is not seen. Group access on an Owner narrows what the owner sees
The address of another organisation A request for a parent, a sibling or an unknown organisation gets a not found response, 404, never a forbidden one, 403
No licence key is stored Every page redirects to Licence. The API answers 402
The licence key expired more than 2 weeks ago Every request that changes anything is refused with 402, whatever the role. See Licensing
No user exists yet Anyone who can reach the dashboard is let in with every permission, until the first user is created
A password must be set Every page redirects to the password form until it is
The organisation, or an organisation above it, is suspended or cancelled Sign-in is refused, with the same message as a wrong password
The last Owner Cannot be deleted or given another role
The user’s own account A user cannot change their own role, or delete their own account

Pages by role

Platform means the user must be in the platform organisation as well as have the role.

Page Owner Admin Operator Viewer
The dashboard and its views yes yes yes yes
A group’s page yes yes yes yes
A terminal’s page, reading it yes yes yes yes
A terminal’s actions yes yes yes no
Certificates, reading it yes yes yes yes
Certificates actions, and the root key panel yes yes no no
Settings, the page yes yes yes yes
Settings, the sign-in policy, alerts and connectivity checks yes yes no no
Settings, the fleet server sections platform platform no no
Groups yes yes no no
Alerts yes yes no no
Maintenance, for one terminal yes yes yes no
Maintenance, for a group yes yes no no
Availability Report yes yes no no
An organisation’s audit trail yes yes no no
Operator Audit platform platform no no
Users yes yes no no
Tokens yes yes no no
Organisations yes yes no no
Server health platform platform platform platform
Licence, reading it platform platform platform platform
Licence, applying or removing a licence key platform platform no no

Groups, Alerts, Availability Report, Users, Tokens and Organisations cannot be opened without the permission. Certificates and Settings open for every role. A section a role cannot open is not shown, and in the platform organisation a section a role cannot change is disabled with a line saying so. The account page opens for every role.

← Files and repositories Log events →