Understanding and Managing User Roles & Permissions

This article explains how user permissions and roles are managed within the Videri Platform. It defines how access is structured across tenants and workspaces, describes available permission levels, and outlines how roles determine access to various feature sets.

Platform Access Structure

Objects existing within the Videri Platform are organized as follows: 

1. A tenant represents the entirety of an organization’s access to the Videri Platform. It includes all users, devices, content, and Workspaces within that organization.

2. A Workspace contains devices and content.

   • Devices can only belong to one Workspace.

   • Content (such as assets, playlists, layouts, and projects) originates in a Workspace and can be shared with other Workspaces.

3. Workspaces are hierarchical.

   • Every tenant has a ROOT Workspace.

   • Admins can create additional Workspaces under ROOT and create child Workspaces within those.

User Access 

User access to objects within the Videri Platform works in the following way:

• Users with access to a Workspace can view all devices and content within that Workspace.

• If a Workspace has any child Workspaces, user access automatically extends to those Workspaces.

• Users with ROOT access inherit visibility into all Workspaces in the tenant.

• Users without access to a Workspace will not see its devices or content unless that content is shared with a Workspace they can access.

Permissions

Permissions determine what a user can perform within each Workspace they have access to for each of the following feature sets:

• Installation

• Devices

• Walls

• Assets

• Playlists

• Layouts

• Projects

• Schedule Management (Scheduling)

• Campaigns

• Tags / Custom Metadata

• User Management (Users & Workspaces)

• Alerts

With the exception of Installation, each feature set supports three levels of access:

Permission Dependencies

In addition to base permission levels, dependencies between feature set permissions also affect user actions. The table below summarizes full access capabilities and details any applicable dependencies for each feature set: 

Detailed action-by-action permission tables for each feature set are available in the Permissions By Feature Set section below. These tables specify exactly what actions are allowed under Full, View, and None access levels.

Inherited View-Only Access

To maintain consistency and prevent broken references, certain permissions automatically include view-only access to related content.

These inherited permissions ensure that users can view referenced content necessary for their workflow, even if they do not have direct access to those features elsewhere in the system.

Roles

Permissions are managed through roles, which act as templates defining access across all feature sets. For example: Configuring a role that allows "full access" to devices will enable any user with that role to interact with every device in every Workspace they have access to. Conversely, configuring a role that allows "view only" access to devices will allow users with that role to see every device in every Workspace they have access to but users with this role will not be able to edit or delete any devices. 

Default System Roles

The following roles are preconfigured for all tenants:

Managing Roles and Permissions

When managing roles, keep in mind that:

• Roles are configured at the tenant level.

• When a role is assigned to a user, that user automatically inherits its permissions.

• Updating a role immediately updates permissions for all users assigned to it.

Only users with a role that grants full access for Users & Workspaces can create, edit, duplicate, and delete roles, including assigning roles to other users.

Configuring a New Role

To create a new role:

1. Click "Users" in the left sidebar to navigate to the Users page.
2. Click "Role Management", located next on the top left of the page.
3. Click the "Create Role" button, located on the top of the page.
4. Click into the input field under the "Manage Role Access" title and name the role.
5. Select the appropriate permissions level for each feature.
6. Click the "Save" button at the bottom of the modal.

Editing a Role Configuration

To edit an existing role:

1. Click "Users" in the left sidebar to navigate to the Users page.
2. Click "Role Management", located next on the top left of the page.
3. Click the icon in the 'Quick actions' column for the target role.
4. Make all necessary changes.
5. Click the "Save" button at the bottom of the modal.

Duplicating a Role

To duplicate a role:

1. Click "Users" in the left sidebar to navigate to the Users page.
2. Click "Role Management", located next on the top left of the page.
3. Click the icon in the 'Quick actions' column for the target role.
4. To rename the new role:
   1. Click the icon in the 'Quick actions' column for the target role.
   2. Click into the input field under the "Manage Role Access" title and type in a new name.

Deleting a Role

To delete an existing role:

1. Click "Users" in the left sidebar to navigate to the Users page.
2. Click "Role Management", located next on the top left of the page.
3. Click the icon in the 'Quick actions' column for the target role.
4. Click "Continue".

Permissions By Feature Set

The following sections specify exactly what actions are allowed under "full", "view-only", and "none" permissions for each feature set outlined in Permissions. 

Installation

Devices

Walls

Assets

Playlists

Layouts

Projects

Schedule Management (Scheduling)

Campaigns

Tags/Custom Metadata Management

User Management (Users & Workspaces)

Alerts