Resources & roles
Resources
Access to the following resources can be managed using roles. This list will continue to be updated as we develop new relevant capabilities.
Resources | Definition |
---|---|
Users | This resource defines CRUD (create, read, update, delete) access to all users. |
Devices | This resource defines CRUD (create, read, update, delete) access to all devices. |
Channels | This resource defines CRUD (create, read, update, delete) access to Channels. |
Views | This resource defines CRUD (create, read, update, delete) access to Views. |
Commands | This resource defines CRUD (create, read, update, delete) access to Commands. |
Events | This resource defines CRUD (create, read, update, delete) access to Events. |
Teleop | This resource defines the ability to configure teleoperate streams, views, and teleoperate devices |
Capture | This resource defines the ability to create capture links that can be sent to operators for capturing video from a cell phone into Formant. |
Annotation | This resource defines CRUD (create, read, update, delete) access to Annotations. |
SSH {webshell, shell} | This resources defines the ability to SSH into a device using a terminal or from a browser using Formant's webshell. |
Comment | This resource defines CRUD (create, read, update, delete) access to Comments. |
Share | This resource defines the ability to generate web links to historical data or teleoperation in Formant that can be sent to third-party. |
Access policies
For convenience, resource access is split to three separate access policy mapping roughly mapping to typical use cases.
- VIEW - Viewer policy allows users to view the specific resource.
- EXECUTE - In addition to VIEW, the Execute policy allows users to execute the specific resources.
- ADMINISTER - The administer policy allows users to administer the specific resource.
Access policy mapping per resource
Resources | VIEW | EXECUTE | ADMINISTER |
---|---|---|---|
User management | - | - | CRUD |
Device management | View devices | - | CRUD |
Channels | View data | - | CRUD |
Views | View data | - | CRUD |
Commands | View commands | Run commands | CRUD |
Events | View events | - | CRUD |
Teleop | - | Teleoperate devices | CRUD |
Capture | - | CREATE Capture links | CREATE Capture links |
Annotation | View annotation | Create annotations | CRUD |
SSH | - | SSH | Enable/Disable SSH access |
Comments | View comments | Add comments | CRUD comments |
Share | - | Generate Share links | Generate Share links |
Default roles & access
The default roles, Viewer, Operator, Administer, that come with Formant maps directly to each of the above policy.
To create a role that maps to custom capabilities, you can build custom roles that are mapped to different access policies for different resources. For example, you can have a user be an administer of device and have no access to any other resource.
Viewers
Viewers are allowed to view all resources within the organization. They are allowed to view telemetry data, and events. This role is typically used for high-level users, such as, your customers.
Resources | VIEW | EXECUTE | ADMINISTER |
---|---|---|---|
User management | - | - | - |
Device management | View devices | - | - |
Channels | View data | - | - |
Views | View data | - | - |
Commands | View commands | - | - |
Events | View events | - | - |
Teleop | - | - | - |
Capture | - | - | - |
Annotation | View annotation | - | - |
SSH | - | - | - |
Comments | View comments | - | - |
Share | - | - | - |
Operators
In addition to viewing all resources Operators are allowed to send commands and teleoperate devices
Resources | VIEW | EXECUTE | ADMINISTER |
---|---|---|---|
User management | - | - | - |
Device management | - | - | - |
Channels | - | - | - |
Views | - | - | - |
Commands | - | Run commands | - |
Events | - | - | - |
Teleop | - | Teleoperate devices | - |
Capture | - | CREATE Capture links | - |
Annotation | - | Create annotations | - |
SSH | - | SSH | - |
Comments | - | Add comments | - |
Share | - | Generate Share links | - |
Organization administrators (Admins)
Organization administrator is an administrator of all resources. The first user is, by default, an organization administrator. There needs to be at least one organization administrator per organization.
Resources | VIEW | EXECUTE | ADMINISTER |
---|---|---|---|
User management | - | - | CRUD |
Device management | View devices | - | CRUD |
Channels | View data | - | CRUD |
Views | View data | - | CRUD |
Commands | View commands | Run commands | CRUD |
Events | View events | - | CRUD |
Teleop | - | Teleoperate devices | CRUD |
Capture | - | CREATE Capture links | CREATE Capture links |
Annotation | View annotation | Create annotations | CRUD |
SSH | - | SSH | Enable/Disable SSH access |
Comments | View comments | Add comments | CRUD comments |
Share | - | Generate Share links | Generate Share links |
Creating custom roles or scoping down access further
If any of the above roles do not suffice, customers can create their own custom roles and assign access policy. For more details, see the custom roles section.
Scope limits access to the capabilities further down to the subset of resources within Formant. Scope can be applied to groups or to individual users or both. Access to the following resources can be scoped down further. For example, a user might have VIEW access to all resources, but only scoped to certain devices defined by tags.
For more details, see the scoping down access section.
Updated over 1 year ago