Roles and access
Who can do what in THMI — the project roles, the capability matrix, and system administration.
What you can see and do in THMI depends on the access you’ve been given. Access is granted per project and per application, so the same person can have one role in the Cloud, another on the on-site Edge, and different access again in another building.
This page is the quick reference for who can do what.
The roles
Within a project there are four roles. Which ones apply depends on the application — the Cloud is where a project is configured, the Edge is where it’s operated on site:
- Viewer — can see, but not change. Available in both applications.
- Operator — an Edge role: day-to-day operation (respond to alarms, change values), but no configuration.
- Manager — a Cloud role: configure the project’s content.
- Admin — a Cloud role: full control of the project, including its permissions.
Separately, a system administrator account has organization-wide access to the Administration area (see below).
Who can do what
Each role includes everything the ones to its left can do.
| In a project | Viewer | Operator | Manager | Admin |
|---|---|---|---|---|
| See tags and their values | ✓ | ✓ | ✓ | ✓ |
| See alarms, events, trends, pages, and documents | ✓ | ✓ | ✓ | ✓ |
| Acknowledge and comment on alarms | ✓ | ✓ | ✓ | |
| Change a writable value | ✓ | ✓ | ✓ | |
| Create, edit, and delete tags | ✓ | ✓ | ||
| Create, edit, and delete alarms and alarm categories | ✓ | ✓ | ||
| Create, edit, and delete pages | ✓ | ✓ | ||
| Create, edit, and delete automation rules | ✓ | ✓ | ||
| Create, edit, and delete documents | ✓ | ✓ | ||
| Create, edit, and delete shared trends | ✓ | ✓ | ||
| Create, edit, and delete events | ✓ | ✓ | ||
| Create, edit, and delete cameras | ✓ | |||
| View and edit integrations | ✓ | |||
| Edit project settings | ✓ | |||
| View and edit the project’s permissions | ✓ |
The rows above describe the role itself. Individual pages, documents, tags and alarm categories can narrow it further — see Item permissions.
Because Operator is an Edge role and Manager/Admin are Cloud roles, a person who both operates on site and configures in the Cloud is typically an Operator on Edge and a Manager (or Admin) in the Cloud — set independently in Permissions.
System administration
Some things sit above any single project. A system administrator account can, in the Administration area:
| Across the organization | System administrator |
|---|---|
| Create and delete projects | ✓ |
| Manage users and their passwords | ✓ |
| Manage user groups and project groups | ✓ |
| Register and manage servers | ✓ |
| Issue access tokens | ✓ |
| View the audit log | ✓ |
Finer-grained access
A couple of areas add controls on top of the project role:
- Item permissions decide access to one thing at a time — a page, a document, a tag’s value, or an alarm category — on top of the role. Alarms are the notable one: they are only ever visible to someone granted a level on their category.
- The anonymous user lets people use a project on the on-site Edge without signing in. It can only ever be a Viewer on Edge — see Permissions.
Accounts
A user account is created by an administrator with an initial password that you change the first time you sign in. Access is then granted to you — directly or through a user group — on each project you work with.