Users, roles and access levels

Create and manage users, choose access levels, define custom roles, and restrict people to the work that concerns them.

Everybody who signs in to SCAD Maps is a user account with an access level, any number of roles (groups such as Security or Cleaning), and two optional restrictions that narrow what the account can see. This page explains how to create and manage accounts, what each access level may do, and how roles and restrictions shape what crew see on the map. Everything here lives in the dashboard under Users & Access; see The admin dashboard for the tour.

Access levels#

The access level says what a person may administer. It is separate from roles, which say which group someone belongs to.

The complete list of what each level can do is in Roles and permissions matrix. Guests, people who join through a shared QR code or PIN, are a fourth kind of account with a reduced feature set; see Invitations, QR codes and access requests.

What a User Admin cannot do#

A User Admin is meant for a site manager who onboards crew, not for someone who controls the whole instance, so the limits are enforced by the server:

• Every account they create is a plain User, whatever they choose in the form.
• They cannot edit, invite to a role, or otherwise touch Admin or User Admin accounts.
• They cannot change anybody's access level or set or reset a password.
• They cannot delete users.
• They cannot give out the GPS admin flag (see below).

The Users tab#

Open Users & Access and choose Users. The table lists every account with its username, email, access level, roles, the two restriction switches and the join date. Click a column heading to sort, and use the search box to find someone by name or email. Long lists are paged.

The row actions are Edit user, Resend invite email, Edit roles and Delete user. On a phone the row opens a small actions sheet with the same choices.

Add a user#

1. Choose Add User.
2. Enter a username and an email address. Usernames are at least three characters. Email addresses must be real domains.
3. Either type a password of at least eight characters, or tick Invite by email (see below).
4. Choose the Access level, tick the restrictions that apply, and pick any Groups the person belongs to.
5. Save. The account is active immediately and the person can sign in straight away.

Invite by email#

Where the instance can send email, the form has an Invite by email switch. With it on, the password field disappears. You only need an email address, and the person receives a link to choose their own password. You never see or handle the password.

• The link is valid for 7 days. If it goes unused, use Resend invite email on the row.
• If you leave the username empty, one is derived from the email address, and the person can pick their own name when they follow the link.
• If the instance cannot send email, the invite switch is not shown. Create the account with a password and hand it over yourself, or use a QR code; see Invitations, QR codes and access requests.

Add many users at once#

Choose Add multiple to paste a list of people, one per line, and create up to 100 accounts in one go. The restrictions, the invite switch and the groups you tick apply to everyone in that batch. After you choose Create users, a summary tells you how many were created or invited, and lists any lines that were skipped or failed with the reason, so you can fix them and run the rest again. This is the quickest way to set up a whole crew of tablet accounts before an event.

Edit a user#

Choose Edit user to change a username, email, restrictions or, for an Admin, the access level and a new password. Some changes take effect on other devices immediately:

• Changing a person's password or access level signs them out everywhere, so an old session cannot keep the old rights.
• Switching Restricted or Own tasks only on or off disconnects their live connection so it reconnects under the new rules right away.

Delete a user#

Only an Admin can delete an account, and you are asked to confirm first. Deletion is permanent and covers the person's data:

• Their notes, activity history, stored locations and uploaded files are deleted.
• Areas they drew stay on the map, but no longer name them as the creator.
• Their sessions end at once.

Restrictions#

By default a user sees the public map, everything colleagues published to it, and the work assigned to them. Two switches on each account tighten that. Both are set per account, in the users table or the add and edit forms, and both are enforced by the server, not just hidden on screen.

If both are on, the stricter one wins for tasks. Administrators are never restricted, whatever the switches say. A restricted person without any role sees only their own items, so give restricted accounts at least one role.

Roles and groups#

A role is a label you define, such as Security, Cleaning, Catering or Stage. A person can have as many as they need. Roles are used for filtering and targeting: who a task is assigned to, which notes a restricted user can see, and which trackers a person can view. They do not by themselves give extra permissions, with one exception described below.

Open Users & Access and choose Roles.

• Create. Type a name (up to 50 characters) and choose a colour, then add it. The colour is used for chips, note and task pins that belong to the role, and filters.
• Edit. Rename a role or change its colour with Edit. Notes and tasks keep their role snapshot and follow the rename.
• Delete. Removing a role removes the label from everyone who had it. It does not delete people or their work. Restricted users who relied on the role lose visibility of what it gave them.
• Member count. The list shows how many people are in each role.

User Admins can create, edit and delete roles and assign people to them. That works because roles are labels rather than permissions.

Assign roles to people#

There are two ways, and both save straight away:

• In the Users table, choose Edit roles on a row, tick the roles and save.
• Choose Role matrix on the Roles tab for a grid with people down the side and roles across the top. Tick a cell to add someone to a role and untick it to remove them. The matrix shows the first 100 people, so use search or Add multiple for larger events.

People can also get roles the moment they join, when an invitation or QR code carries them; see Invitations, QR codes and access requests.

GPS admin#

The one permission a role can carry is GPS admin. Members of a GPS admin role may set up the machinery tracking integration, name trackers and choose who sees which one, without receiving any user-management rights. Only a full Admin can switch the flag on or off, using the checkbox in the Roles list. A User Admin cannot set it, cannot attach a flagged role to someone, and it is silently ignored if they try. See Machinery GPS tracking.

Practical setups#