Access levels

↩ Administration

Three separate things decide what someone can reach in JOATOS: whether they have console access, what their permission groups grant, and whether those groups are scoped to particular items. This article explains how they fit together. It's worth reading before you add anyone, because the defaults are deliberately restrictive.

New users get nothing by default

Console access is off for every new user — whether you create them, invite them, or they arrive through directory sync. Someone in that state:

• can sign in to the self-service portal, and
• is stopped at the console with a message pointing them there.

This is intentional, not a fault. But it does mean that adding a user and expecting them to see the console will not work until you grant console access. If a new colleague reports that JOATOS "isn't working" or is "empty", this is almost always why.

The three levels

Administrator isn't a separate switch: it's membership of the built-in Administrators group. Adding someone to it turns console access on and keeps it on.

Console access with no groups is a dead end. The person can sign in and will find nothing there. Always pair console access with at least one permission group.

What each layer controls

Think of it as three questions asked in order:

1. Can they get in? — console access.
2. Which parts? — permission groups, granting None / View / Write per module.
3. Which items within those parts? — asset and diagram scoping on the group.

A user in several groups gets the union of what those groups allow. See Permission groups and access control for groups and scoping in detail.

Administrators bypass everything

An administrator is org-wide by definition: scoping doesn't apply to them, and they can read every stored credential back in full (see Adding a credential § Who can see a stored secret). Treat the Administrators group as the most powerful thing you can hand out, and keep it small.

Notes & tips

• Grant console access deliberately, one person at a time. The default exists so nobody gets the console by accident.
• If someone can sign in but every page is empty or missing, check their groups — not their console access.
• If they can't reach the console at all, check console access — not their groups.

Related

• Managing users and roles
• Permission groups and access control
• Enabling and disabling modules