Permissions

The complete permission catalog exactly as the role switches read, the implication rules between them, and what each permission gates across the app, page by page.

View as Markdown

A permission is one switch in a role's panel on the Users page (see Roles). There are 22 of them, grouped by area, and every screen in the app decides what to draw and what to allow by testing the permissions of the identity signed in on that connection. This page lists the catalog exactly as the switches read, the rules that tie switches together, and what each one gates.

Two refusals look different everywhere in the app, and it helps to know which is which: a command the role will never permit is not drawn at all (a Viewer reads a bar the size of what a Viewer can do), while a command refused by the situation (nothing selected, a run holding the station, the runtime stopped) stays drawn, greyed, with the reason as its tooltip. Where a permission is also checked when a command is dispatched, the refusal lands in the action feed with one of the messages quoted below.

The catalog

Each area below is one group of the role panel, in the panel's order, with the counter it shows and the switch labels and descriptions verbatim.

Dashboard (3)

Switch	Description
View dashboards	Open and watch the operator screens.
Operate dashboards	Use buttons, toggles and inputs on dashboards.
Edit dashboards	Create, change and delete screens and components.

Connector (3)

Switch	Description
View connector	Browse devices and tags and read live values.
Calibrate tags	Adjust only a tag's calibration, without configuring devices.
Configure connector	Create, change and delete devices and tags.

Process (4)

Switch	Description
Look at models	Open models, units, visualization, setup and templates without running or changing them.
Run procedures	Run existing procedures and view results.
Edit recipes & evaluations	Change recipes, evaluations and actions without touching the model/unit structure.
Manage process	Create, change and delete procedure models and their unit structure, the label and report layouts, and the unit's printer queues.

Histories (3)

Switch	Description
View histories	Consult recorded runs. The Events page has a permission of its own.
Export/import histories	Export runs and reports (CSV, XLSX, PDF, GLAB) and import GLAB runs.
Manage histories	Delete recorded runs and write, change or remove their comments and annotations.

Logic (3)

Switch	Description
View logic	Browse the address space and read points.
Configure logic	Create and change variables, actions, triggers and alarms.
Operate logic	Write variables, run actions and acknowledge alarms.

Validation (1)

Switch	Description
View validation	Open the Validation page, the configuration-health view of what the station has to repair.

System (5)

Switch	Description
View events	Open the Events page: alarm, occurrence and interlock histories plus the program-level diagnostics console. On by default; Admin always has it and can turn it off for other roles.
Change settings	Change the station's settings.
Manage agent (MCP)	Configure AI-agent access to the station.
Manage local users	Create, edit and remove users, roles and permissions. Admin only.
Remote access (LAN)	Use the station from another device on the network. Off for Not signed in by default, so enabling remote viewing exposes nothing until a role grants this.

Implication rules

The rules below are the single definition of how switches depend on each other. The role panel applies them live as you flip, and the station applies them again when it stores a role, so a stored role is always self-consistent and the check behind every screen is a plain bit test.

What requires what

Switch	Requires	Turning it on also turns on	Turning the requirement off also turns off
Operate dashboards	View dashboards	View dashboards
Edit dashboards	View dashboards	View dashboards
Calibrate tags	View connector	View connector
Configure connector	View connector	View connector
Run procedures	Look at models	Look at models
Edit recipes & evaluations	Run procedures	Run procedures, Look at models
Manage process	Edit recipes & evaluations	Edit recipes & evaluations, Run procedures, Look at models
Export/import histories	View histories	View histories
Manage histories	View histories	View histories
Configure logic	View logic	View logic
Operate logic	View logic	View logic
View dashboards			Operate dashboards, Edit dashboards
View connector			Calibrate tags, Configure connector
Look at models			Run procedures, and through it Edit recipes & evaluations and Manage process
View histories			Export/import histories, Manage histories
View logic			Configure logic, Operate logic

The four Process switches are a chain: Look at models, then Run procedures, then Edit recipes & evaluations, then Manage process. Each level holds the ones before it. Everything else in the catalog is independent: View events, Change settings, Manage agent (MCP), View validation and Remote access (LAN) require nothing and are required by nothing.

The fixed bits

Rule	What it means
The floor: View dashboards	Held by every role, always. The switch is on and tagged Required on every editable role, and a stored role always carries it. A user whose role has been deleted still holds it, and nothing else.
Admin only: Manage local users	Only the Admin role holds it. The switch is locked off on every other role, and a role saved with it is stored without it.
Admin holds everything	The Admin mask is every switch in the catalog, and it cannot be edited.
Required	The tag on a switch that is on and locked because it is the floor or because a switch that requires it is on. Admin's switches show no tag; they are simply fixed.

The default masks

Role	Switches
Not signed in (as shipped)	Every switch except Manage local users and Remote access (LAN).
A new role	View dashboards only.
Viewer	View dashboards, View connector, Look at models, View histories, View logic, View validation, View events, Remote access (LAN).
Operator	Viewer plus Operate dashboards, Operate logic, Run procedures.
Maintainer	Operator plus Calibrate tags, Configure connector, Export/import histories, Manage histories.
Developer	Maintainer plus Edit dashboards, Configure logic, Manage process (and so Edit recipes & evaluations).

No factory role except Admin holds Change settings, Manage agent (MCP) or Manage local users. Not signed in as shipped holds the first two.

The reach strip

Every role on the Users page is also drawn as six pips. Each pip shows the deepest switch the role holds in that area, on a four-rung ruler: No access, View, Operate, Manage. The strip is a silhouette, not the catalog: the exact truth is always the switches.

Pip	Manage (full)	Operate (middle)	View (low)
Dashboard	Edit dashboards	Operate dashboards	View dashboards
Connector	Configure connector	Calibrate tags	View connector
Process	Manage process	Edit recipes & evaluations, or Run procedures	Look at models
Histories	Manage histories	Export/import histories	View histories or View validation
Logic	Configure logic	Operate logic	View logic
System	Manage local users	Change settings or Manage agent (MCP)	Remote access (LAN)

Two switches leave no mark on the strip: View events lights nothing, and View validation only counts toward the Histories pip's View rung. The summary beside a strip, "Can change of 6 areas", counts the pips at Operate or Manage; "View-only" means at least one pip at View and none higher; "No access" means every pip empty.

What each permission gates

The rail draws an entry only for an identity that holds the permission the entry names (any one of them where several are listed), and the page behind it refuses the route on the same test: a browser that types the address anyway gets the sign-in surface instead of the page. Inside a page, the verbs and fields below are drawn only for a role that holds the switch, and re-checked when pressed.

Dashboard

Switch	Rail and routes	Verbs, fields and surfaces
View dashboards	View (always drawn); the View page, the Users page and the Account page open for every identity.	Watching any screen. Which screens a role sees is further narrowed by each screen's Visible to checklist (see Screen settings): no role checked means everyone, and Admin always sees every screen. Materialized model screens follow Look at models instead.
Operate dashboards		Every command component on an operator-authored screen: buttons, toggles, inputs, selectors, setpoints, step keys. A denied press stays in place with "Dashboard operation permission required." A component whose target is a Process operation (starting a run, staging, a comment, a procedure pick, an interlock rearm) needs Run procedures as well; the refusal reads "Run procedures permission required."
Edit dashboards		On View: the Edit pencil, New dashboard, Copy, Delete, and the folder commands (New folder, Rename, Remove, moving screens). On Process: Edit dashboard on a model's screen, left out rather than greyed for a role without it. It also makes the identity one that decides on updates, so the new-release notice is addressed to it.

Connector

Switch	Rail and routes	Verbs, fields and surfaces
View connector	Connector; the Connector page.	Browsing drivers, lines, folders, devices and tags, reading live values.
Calibrate tags		On a tag, the Calibration stage's manual fields and its two-point assistant, and nothing else. Without it (and without Configure connector) the stage reads "The “Calibrate tags” or “Configure connector” permission is required to edit the Calibration stage."
Configure connector		Every configuration verb: New device, Add tag, Copy device, Enable, Disable, Delete, folders and serial lines, Rename, Refresh and Discover, Matter pairing, the Scale stage ("The “Configure connector” permission is required to edit the Scale stage."), every device and tag field, and Replace all references. Rewriting a reference that a unit interlock uses needs Manage process on top ("Replacing a Unit interlock source requires Process manage permission."). The general refusal reads "Changing the Connector requires the "Connector configure" permission."

Process

Switch	Rail and routes	Verbs, fields and surfaces
Look at models	Process (any of the four Process switches, or View histories); the Process page and the detached run and recipe chart windows.	The Models and Templates roots, whole and read-only. Model screens on View are visible with it.
Run procedures	Same entry.	On a unit: Start, Hold, Resume, Stop, Abort, staging the next procedure and its metadata, comments, rearming an interlock; Start all and Stop all; the same operations reached from a dashboard component (together with Operate dashboards on an operator-authored screen). In Histories: emitting a label for a recorded run and resending a report or label, both together with View histories.
Edit recipes & evaluations	Same entry.	The command bar's Setup verbs: Alias set, Procedure, Datalog, Recipe, Evaluation, Occurrence, Action and Command, and their Remove counterparts, plus the fields of the recipe, evaluation, occurrence, alias set, datalog, procedure and action panels ("Changing actions needs the "Edit recipes & evaluations" permission."). Without Manage process the tree shows Models reduced to their Setup groups and hides Templates.
Manage process	Same entry.	Model, Folder, Rename folder, Remove folder, Copy model, Delete model, units, Channels, Metadata, Automation, Productivity, Printers, interlocks, Dashboard and Panel under Visualization with Remove dashboard, Remove panel and Show on View, and Report and Label templates with Delete report and Delete label template. The workspace refusal reads "Managing this workspace requires the "Manage process" permission."

Histories

Switch	Rail and routes	Verbs, fields and surfaces
View histories	Process (on its own, even with no Process switch); the Histories root in the Process tree; the recorded-run browser and the run chart windows.	Browsing recorded runs, their documents and notes. Resending a report or label also needs Run procedures ("Resending a report needs both Histories access and the Run procedures permission.").
Export/import histories		Export CSV, XLSX and GLAB, Generate PDF, opening or downloading a generated report, importing GLAB runs. On the Events page, every Export and the support package ("Taking rows or a support package off the station is an export").
Manage histories		In the recorded-run browser: Delete on the command bar, the ticks that gather runs and the bulk Delete strip above the list, and the note and marker boxes of a run, adding, editing in place and deleting a row of either. A role without it is drawn none of them, so it reads the record without a verb that changes it; the situations that refuse Delete for a role that holds it stay as they are: nothing selected, a run still recording, another delete in flight, the station read-only.

Logic

Switch	Rail and routes	Verbs, fields and surfaces
View logic	Logic; the Logic page.	Browsing the address space and reading points. A view-only role sees the whole page read-only.
Configure logic		Creating, copying, renaming, enabling, disabling, deleting and filing variables, actions, triggers, alarms and folders, every definition field, and the asset library imports (images, icons, colors, symbols). The refusal reads "Your role can view Logic but cannot configure it (variables, actions, triggers, alarms and assets)."
Operate logic		Set value on a variable, Run on an action, Acknowledge and Ack all on alarms, on the Logic page and on the Events page's Current alarms card. The refusal reads "Your role can view Logic but cannot operate it (write values, run actions, acknowledge alarms)."

Validation

Switch	Rail and routes	Verbs, fields and surfaces
View validation	Validation; the Validation page.	The findings and Rescan.

System

Switch	Rail and routes	Verbs, fields and surfaces
View events	Events; the Events page.	The four tabs. On Settings, the OPC UA server's Warnings count is a link into Events only with it; otherwise a plain number.
Change settings	Settings; the Settings page.	Every setting on that page (client and equipment access additionally need the station's own window). On the Events console, Start and Stop capture ("Starting or stopping the detailed capture needs the Change settings permission."). Like Edit dashboards, it makes the identity one that decides on updates.
Manage agent (MCP)	Agent; the Agent page.	The master switch, the port and the allowed areas.
Manage local users		On the Users page: the Users and Roles branches, the column footer, Remove user and Delete role, and every panel behind them. On the Account page: Sign in and Sign out of the Ganter account, and the Support & maintenance contact and Integrator ID fields. Admin sees every dashboard regardless of its Visible to checklist.
Remote access (LAN)	Viewing at all from a device on the network.	A browser on another machine whose identity lacks it gets the sign-in surface, "Sign in to view this station from the network.", instead of any page. The station's own window and a browser on the station's machine are never gated by it. See Signing in.

What permissions do not gate

The runtime. Acquisition, recording, the logic sweep, alarms, the embedded OPC UA server and the MCP endpoint run whatever the roles say; only the free-mode limit stops them (see Subscription).
Signing in and out. The user chip and the Signed in now root are open to every identity.
The station's own operations behind the screens: an agent connected over MCP has its own allowed areas on the Agent page and does not sign in as a local user.
The Feedback form on the Account page, which is gated by the Ganter account rather than by a local role.