Introduction

This guide provides instructions for managing roles and user accounts within the CloudDeck platform.

It explains how to create and configure roles, define access permissions, create user accounts, and assign roles to users. Roles determine which platform modules users can access, what actions they can perform, and which resources they can view or manage.

The guide is divided into two main sections: Role Management and Account Management. Roles should be created and configured before accounts are created, because every account must be assigned an existing role.

Role Management

This section explains how to create and configure roles before assigning them to user accounts. Roles define which platform modules users can access, what actions they can perform, and which resources they can view or manage.

How Role Permissions Work

The Roles page lists the platform modules. The modules generally correspond to the sections in the left-hand navigation menu. Each module can have high-level permissions and, where supported, more detailed permissions.

Permission Colours

Click a permission label to switch it between disabled (red) and enabled (green).

• Navigable: Controls whether the module is shown in the user's left-hand menu.
• Create: Controls whether the user can create new items in that module.
• Other permission labels: Control module-specific actions, such as reporting or exporting, where available.

Create a Role

1. Open Administration → Roles.
2. Click New to create a role.
3. Enter a Name. This field is required.
4. Optionally add Tags. Search for an existing tag or enter a new tag and press Enter.
5. Optionally add Notes to describe the purpose of the role.
6. Leave Application host URL blank unless accounts using this role must open an alternate user interface. Only enter a URL for that specific requirement.
7. Select Save.

Set a Parent Role (Optional)

After creating the role, open its role details. In the Parent Role section, select Change to assign a parent role.

1. Click Change to display the available roles.
2. Select the role you want to assign as the parent. Use the Search field or Advanced Search to find a specific role.
3. Click Assign to confirm the selection.
4. The selected parent role will then appear in the Parent Role section.
5. If no parent role is required, leave this section unassigned.

Configure Module Access

On the role's Access tab, review the module list. Modules are grouped into areas such as Sites, Visitor Journeys, Asset Library and Administration.

1. Find the module you want to configure.
2. Use the permission labels in the Module Access column to enable or disable the relevant permissions.
3. Enable Navigable if users should see the module in their left-hand menu.
4. Enable Create only if users should be allowed to create new items in that module.
5. Review any additional module-specific permissions shown in the same row.
6. Select the module name to open its detailed configuration.

The Items and Access Attributes columns provide a quick summary of the detailed permissions configured for that module.

Configure Attributes

Inside a module, open the Attributes tab. Attributes control what users are allowed to do to items in that module, and which fields or settings they can change.

• Full access: A broad permission that can delegate full item-edit access. Review any specific blocks that may override or restrict it.
• Item attributes: Actions such as deleting an existing item.
• Field attributes: Actions such as editing a name, notes, location, contact details, serial number, additional data or a secret.
• Hardware attributes: Permissions for changing hardware-related settings, where applicable.

Each attribute has an Edit control. Open it to change the permission state. A red Block label indicates that the action is blocked; change the setting as required for the role.

Configure Items and Item Access

Open the Items tab to control which items or records the role can access in that module. For example, in the Sites module, this determines which sites are available to users with the role.

• Inherited access: Use the inheritance option when users should have access to all sites covered by the account/platform inheritance setting.
• Selected items: Use item-level selection when users should only have access to specific sites. Add or select the required sites rather than granting broad inherited access.
• The item list shows the configured items and their inheritance status. Use Edit to change an item's settings; use Add or Remove where available to manage the list.

The example shown includes site and network item permissions. The exact item choices depend on the module being configured.

Example: Create a Read-Only Role for Selected Sites

Use this as a starting point for a read-only site access role:

1. Create a role with a clear name, such as “Site Viewer – Selected Sites”.
2. In the Sites module, enable Navigable so Sites appears in the left-hand menu.
3. Leave Create disabled.
4. Open Sites → Items and select only the sites this role should be able to access. Do not use broad inherited access if the user must be restricted to a subset.
5. Open Sites → Attributes and keep Delete blocked.
6. Keep field-editing permissions blocked, including Edit name, Edit notes, Edit site location, Edit contact details and other edit attributes.
7. Keep hardware modification and secret-edit permissions blocked unless there is a specific requirement.
8. Review the role summary and test it with an appropriate account before rolling it out.

Review Checklist

• ☐ The role has a clear name and purpose.
• ☐ Tags and notes have been added if useful.
• ☐ Application host URL is blank unless an alternate interface is required.
• ☐ The parent role is correct, or intentionally left unassigned.
• ☐ Navigable is enabled only for modules users should see.
• ☐ Create and other module actions are enabled only when required.
• ☐ Attributes allow only the necessary actions; sensitive edit/delete permissions are reviewed.
• ☐ Items access is limited to the intended records or sites.
• ☐ The role has been tested before being assigned to an account.

Key Points to Remember

• Module access controls menu visibility and high-level actions.
• Attributes control what users can do to items and which fields they can change.
• Items control which records, such as sites, users can access.
• Parent Role is configured separately from module-level Items inheritance.
• Use the least-privilege approach: enable only what the user needs.

Account Management

This section explains how to create user accounts within the CloudDeck platform and assign them an existing role. Every account must have a role, so create and configure the required role before creating the account.

Create a New Account

To create a new account and assign a role during account creation:

1. Navigate to Administration → Accounts.
2. Select Create (or the Add option).
3. Enter the account details:
   • Email: Enter the user's email address.
   • Full name: Enter the user's full name.
   • Password: Set an initial password.
   • Confirm password: Re-enter the password.
   • Tags: Optionally add relevant tags.
4. Select the authentication method:
   • Default: The user authenticates using their account credentials.
   • Use an identity provider: The user authenticates through a configured identity provider.
5. Under Select a role for this account, select the role you want to assign.
6. Review the account details and selected role.
7. Click Save to create the account.

Assign a Role to an Existing Account

You can also assign an account to a role after the account has already been created.

1. Navigate to Administration → Roles.
2. Select the role you want to assign.
3. Open the Accounts tab.
4. Under Accounts who are members of this role, click Add.
5. Search for and select the existing account you want to add.
6. Confirm the selection to assign the account to the role.
7. Verify that the account appears in the list of role members.