Custom roles and permissions

Updated 5 Oct 2026

When the built-in roles (Admin / Operator / Viewer) don't fit, create a custom role with exactly the permissions you want — for example "can edit dashboards and view devices, but nothing else."

Only the Owner (or a member with Manage roles) can create custom roles, and a member can only work within their own permissions: a role you create or edit can't include anything your own role lacks. The Owner is never limited. Find them on the Team page under the Roles tab.

See what each role allows

The Roles tab lists every built-in role with exactly what it allows, area by area, and the areas it has no access to. Click a custom role's permission count to see its list the same way. When you invite someone, the invite window shows what the role you picked can do before you send it.

Create a role

Go to Team → Roles → New role — or click Start a new role from … under one of the built-in roles.
Under Start from, pick Blank or a built-in role (Admin, Operator, Viewer). Picking a role ticks its permissions for you; you then add or remove any of them. Two kinds are left unticked, and named so you can decide:
- Run macros — it can move physical equipment, so it is never ticked for you. Tick it yourself if this role needs it.
- Permissions you don't hold yourself (if you're not the Owner) — you can't grant those.
Give it a name (e.g. Field technician). The built-in names — Owner, Admin, Operator, Viewer — can't be reused, and two roles can't share a name. Once you delete a role, its name is free to use again.
Tick or untick the permissions to grant. They're grouped by area:
- Devices — view, create, edit, delete, send commands
- Parameters — view, change (thresholds and tag settings)
- Gateways — view, create, edit, delete, provision (flash firmware from the browser), debug
- Dashboards — view, create, edit, delete
- Rules / Actions / Macros — view, create, edit, delete (and toggle/trigger)
- Data forwarding — view (destinations with their credentials hidden), manage (add, edit, test, switch on/off and delete destinations). Of the built-in roles, Admin has both, Viewer can view, Operator has neither.
- Billing — view (the plan, orders and invoices). Changing the plan, paying and managing payment methods are always Owner-only and can't be granted to a role.
- Team — view, invite, manage members; manage roles
- Activity log — view who changed what in the account (Activity log). Of the built-in roles only Admin has it; Viewer does not.
Save. It's saved as a new custom role — the built-in role you started from doesn't change. The role now appears in the role picker when you invite or reassign a member — for anyone whose own permissions cover it.

Edit or delete a role

Edit a role to add or remove permissions. Members holding that role pick up the change within a minute.
You can only edit or delete a role that sits within your own permissions — a role that can do something you can't is off limits. Editing the role you hold yourself can only remove permissions, never add them; if a role needs to grow beyond what you hold, ask the Owner or another admin.
Delete is blocked while the role is still assigned to someone — reassign those members first, then delete.

Viewing comes with every permission

Any permission in an area includes viewing that area — Edit devices includes View devices, Manage data forwarding includes View data forwarding. You don't have to tick the view box separately, and older custom roles that only ticked "edit" keep working. The reverse also holds: a role with no permission in an area can't open it at all — with nothing ticked under Rules, the Rules page isn't available to that member.

Tips

Start from the closest built-in role, then add or remove what you need.
Grant view permissions generously and edit/delete sparingly — least privilege keeps mistakes contained.
Reserved names (Owner, Admin, Operator, Viewer) can't be reused for custom roles.