Tiaris guide
Roles and permissions
Choose appropriate Console access and distinguish it from accounts on managed workstations.
A person signs in with a global account and works inside a selected organization. Their effective organization role controls the tasks they can perform there. Switching organizations can change their permissions.
Organization roles
Section titled “Organization roles”| Task | Viewer | Operator | Manager | Owner |
|---|---|---|---|---|
| Read management state and inspect computers | Yes | Yes | Yes | Yes |
| Perform computer operations | No | Yes | Yes | Yes |
| Manage Blueprints, Policies, App Lists, and deployments | No | Yes | Yes | Yes |
| Manage people and organization details | No | No | Yes | Yes |
| Hold the organization’s highest level of control | No | No | No | Yes |
The Console hides or disables unavailable controls. A permitted role does not bypass a computer’s capability requirements, destructive confirmation, or deployment approval.
Only an Owner can grant, change, or remove Owner memberships. The last Owner cannot be removed or demoted while that would leave the organization without an Owner. Arrange a valid ownership transition before removing that person’s access.
Operator workspace
Section titled “Operator workspace”The advanced Operator workspace is a separate destination in the account menu. Access requires both an eligible effective role and the Console’s operator capability. A Viewer does not get this workspace; an eligible role alone does not establish that the capability was supplied in the current session.
This workspace exposes exact configuration, source, and release controls. Ordinary Blueprint and Policy editing remains in Configuration. See Use the Operator workspace.
Reseller and platform accounts
Section titled “Reseller and platform accounts”Reseller accounts can access the organizations assigned to their reseller team. Platform administrators can access platform administration and organizations within their platform authority. These are account-level permissions in addition to ordinary organization membership.
An organization Owner does not automatically become a platform administrator. Confirm the account type and selected organization before using Organizations or Platform Console.
Console access is not workstation sign-in
Section titled “Console access is not workstation sign-in”Inviting someone under Settings > People grants access to the management Console. Workstation accounts and directory connections are configured under Settings > Sign-in sources and selected by a Policy.
A person can need workstation sign-in without any permission to administer Tiaris. Keep those two access decisions separate. Follow directory sign-in to configure managed-computer accounts.
Review and change access
Section titled “Review and change access”Owners and Managers can change memberships under Settings > People. Choose the least access needed, review existing memberships, and remove obsolete access. For invitation delivery, account verification, and recovery, see People and account security.