Management roles in Nebula Beta
User roles and permissions
You can grant users a series of permissions to manage Salto Nebula, depending on your requirements. The ability to manage other users' permissions, access rights, and the configuration of devices depends on the management role you grant to a user.
Management roles and the permissions each role contains refer to the management of resources within Nebula. To manage user access in an installation, you use the access rights option once a user has been created.
Granting user management roles
For a user to manage permissions of any type, they must have a valid email address.
Below you can find a list of user management roles that are available by default in Nebula. Note that these roles can be combined as per your requirements. Once you assign a management role to a user, the type of role assigned is shown beside the user's name on the user profile screen.
The role of owner cannot be granted to users via the create/edit user section of Nebula. For more on this role, see the section on owners.
Owner
The role of owner is the most powerful role in the Nebula system. It's similar to the system manager role, but has two major differences. A system manager cannot delete or transfer installations whereas an owner can.
The owner role is a special role in that it cannot be granted to a user using the regular create user flow. Instead, owners are created automatically when an installation is first created by the first installation user. The owner role can also be transferred from one user to another using the transfer installation ownership functionality.
Here are some considerations for the owner role:
- There can be one user in an installation at any time with the owner role.
- The owner role can only be acquired when creating a new installation or by receiving the ownership of the installation from another user in a transfer.
- A user who has the owner role cannot be deleted.
- A user who has the owner role cannot be blocked.
- There must always be one owner in an installation.
System manager
A system manager can manage all aspects of the Nebula system and, aside from the owner, they can be considered as the main administrators of an installation. Installations can contain multiple system managers.
System managers can create, view, modify and delete other users. They can assign access rights and keys (digital and physical keys) to other users. They can modify access rights and access points (create, edit and delete). They can create, edit and delete calendars and opening modes. They can also view all activity in the installation they manage.
They can assign the system manager role to other users and they have access to the Devices section of Nebula. This means they can unlock online access points directly from Nebula web. They can also configure and manage devices using the Nebula app. Note that if you select the System manager option, by default all the other roles will be checked.
A system manager can delete another system manager.
Users who have management roles cannot modify their own role.
You cannot delete yourself.
User manager
A common use case for a user manager could be a person who is at the front desk of a hotel or building. Their main task in Nebula is to create users and assign keys to them.
A user manager can create, view, modify and delete other users. They can assign access rights and keys (both digital and physical) to other users.
They can't modify access rights or access points, but they can view them so when they assign access rights they can see the access points and schedules that these access rights contain. They do not have access to the devices or activity sections of Nebula.
A user manager cannot delete a system manager, nor modify a system manager's role.
User managers cannot create users with management roles.
Access right manager
Access right managers have limited permissions in Nebula, but you might find it useful to combine this role with that of a user manager. This would allow someone on the front desk of a building or hotel to have more freedom when it comes to creating and assigning access rights to users.
An access right manager can create, modify and delete access rights. They cannot modify access points, but they can view them to be able to assign access points to access rights or remove them. They can also modify existing access right schedules or create new ones.
They cannot assign access rights to users and they do not have access to the devices or activity sections of Nebula.
Device manager
A device manager can create, modify and delete electronic locks and their associated access points as well as other devices such as gateways or encoders. This role is intended for installers and maintenance teams.
Although device managers can create devices using Nebula web, the configuration of devices such as electronic locks or gateways is done via the Devices section of the Salto Nebula app. By assigning this role to a user, you give them access to this section of the app.
Device managers can view installation calendars and opening mode schedules but they cannot modify them. They cannot create or edit users or access rights, nor can they view installation activity.
They can also view the status of devices, allowing them to diagnose any possible issues with the system.
See installer for more details.
Unit manager
Your installation needs to have units created to be able to grant this role to users.
Unlike system or device managers, unit managers have no permission to manage at the installation level. Instead, they manage their own unit and do not see any of Nebula's access control elements at the installation level. They can only view and manage elements belonging to their own unit, and they mainly allow other users access by assigning them keys.
Unit managers have a reduced view of Nebula
An example of a unit manager could be a tenant of an apartment located inside a larger apartment building.
There are two types of unit managers:
- Unit managers who can create other unit managers.
- Unit managers who cannot create other unit managers.
Unit managers generally create and manage regular users who are keyholders with no management permissions. However, if you mark the checkbox "Can also create other unit managers" when creating a unit user, the unit manager will not only be able to create keyholders within the unit, but also other unit managers.
Creating unit managers
If you mark the first checkbox, but leave the second one blank, the unit manager created will only have permission to create regular keyholder users in the unit.
You cannot create unit managers from the main installation Users section. Instead, you must first create a unit and then add users to that specific unit.