Roles and permissions

What a person can do in your portal comes from their roles: one main role, and any roles of your own they hold beside it. Administrators give roles under Settings > People & access, as described in People and access. Each role applies at the Sites assigned to it; an administrator always works on All sites.

Built-in roles

The five built-in roles cannot be changed or deleted. These descriptions assume no additional grants: a custom role can add permissions, including configuration access, to the main role.

Role	For
Administrator	Everything in the portal, including people and their roles, with every extra permission below.
Supervisor	Everything an Operator does, and seeing the settings, Sites, cameras, people and evidence holds without changing them.
Operator	Watching video, handling alarms, running response procedures, and working with exports and investigation cases.
Viewer	Watching live and recorded video and seeing alarms and Insights, without acting on them.
Read-only	Seeing every section the portal shows it, without changing, operating, sharing or downloading anything.

Supervisors and Read-only people open administration pages to read them: the values show, without a way to save them.

Extra permissions

Some actions need an extra permission, which an administrator ticks on the person's Manage page. Only Operators and Supervisors can hold one: untick them to save a person as Viewer, Read-only or Only the roles below. Every change needs a reason, and the grant or revocation is recorded in Audit history with that reason. Some appear only when your package includes their feature.

Permission	What it allows
Manage evidence preservation holds	Preserving evidence, reviewing holds and requesting their release.
Reopen resolved alarms and incidents	Returning resolved alarms and incidents to review, with a reason.
Email alarms to addresses outside this system	Sending an alarm to an address that is not a person in the portal.
Operate Site outputs	Switching a Site's outputs.
Talk through site speakers	Talking through a Site speaker. Needs Operate Site outputs too.
Configure Site control devices and Cloud arming policies	Setting up control devices and Cloud arming. On this page, administrators only.
Arm or disarm panels and Cloud alarm handling	Controlling manual Cloud arming groups and panel areas, and isolating panel zones or removing their isolation.
Disarm panels and Cloud alarm handling	Disarming a Cloud group or panel area, or isolating a panel zone. It also needs Arm or disarm panels and Cloud alarm handling; output control is a separate permission.
Force-arm Cloud alarm handling	Arming although some sources are active or faulty. Needs the arming permission too.
Bypass Cloud arming sources	Leaving one source out of a group for a set time or until the next disarm. Needs the arming permission too.

The site-control and arming permissions sit under Site controls and arming. See Cloud arming and site controls.

Roles of your own

Select Roles on People & access. Built-in roles lists the five protected roles, and Your roles your portal's own, up to 100.

1. Select New role, or Copy beside a role to start from its permissions.
2. Enter a Name and, optionally, a Description.
3. Under Permissions, tick what the role lets a person see, change, operate, and share or export, section by section.
4. Select Save. If a permission needs its section's view, the editor ticks that view: review the role and save again.

Give the role on a person's Manage page, or when you invite them. Its permissions add to their main role, and a person can hold up to 16 of your roles. Most administrator tasks are also open to a role of your own with the same permissions. Managing people and roles, the video link policy and revoking video links stay with the Administrator role.

Before you save a change to the permissions of a role that people hold, the editor lists them and what they gain and lose. Confirm with the button that counts them, such as Save for 2 people. They are signed out within about two minutes and sign in again with the new access.

Delete appears only for a role nobody holds. Supervisors and Read-only people can open your roles to read them, without New role, Copy or Delete.