Access Management

User access on Xyte is managed via two distinct methods, which combine: tenant-wide access, granted by membership of the automatically-created global groups, and space-level access, granted per space to a user or a group.

Both apply to users created in this tenant and to external users given explicit access.

Each Space in the Overview tree has its own access rights and can be managed independently. Space-level access defines what the user can do in and to the Space, and to all the Devices directly inside of it.

Inheritance

Any changes to the access levels of a Space automatically propagate to all the Spaces below it. Giving View access to a user on a "UK" Space will therefore grant the same permission on all its child and grandchild Spaces, such as "London".

Levels

Space level access can be of three different levels — View, Edit or Admin. Each level covers everything the level to its left covers, plus more:

Action	View	Edit	Admin
View spaces, devices, assets, incidents, history	✅	✅	✅
Add devices and assets to the space	❌	✅	✅
Edit device details, configuration, notes	❌	✅	✅
Send commands to devices	❌	✅	✅
Open, update and close incidents	❌	✅	✅
Move devices between spaces	❌	✅	✅
Delete devices and assets	❌	❌	✅
Replace, merge and split devices	❌	❌	✅
Manage licenses and warranties	❌	❌	✅
Create, edit, move and delete sub-spaces	❌	❌	✅
Grant and revoke access to the space	❌	❌	✅

📘
Deleting a device requires Admin
Edit covers day-to-day device work — claiming, configuring, sending commands, handling incidents and moving devices — but it does not include deleting a device or an asset. If a team needs to decommission devices, grant them Admin on the spaces they are responsible for.

📘
"Admin" means Admin on the space
Space-level Admin is not the same as an organization administrator. A user — or a group — can hold Admin on one space and no access at all elsewhere. Organization administrators can do everything above in every space, and are the only ones who can manage users, groups, API keys and billing.

Access Level Computation

A user might be granted different access levels to the same space, if that user belongs to one or more Groups that have access to the Space.

To calculate the actual access rights, Xyte picks the highest access level granted to the user, directly or indirectly via Groups.