Appendix A: Role & Permission Quick Reference

Overview

This appendix summarises the operation permissions of the three roles (System Administrator, Tenant Administrator, End‑User) across all functional modules, facilitating permission planning and daily reference for administrators.

Symbol Legend

Symbol	Meaning
●	Allowed
○	Not Allowed
—	Not applicable (this role cannot access this module)

I. System Administrator Permissions

Module	Operation	System Administrator
Login & Logout	Log in to the platform	●
	Log out	●
Tenant Management	Create tenant	●
	Edit tenant	●
	Delete tenant	●
	View tenant list	●
	Reset tenant password	●
Tenant Profiles	Create profile	●
	Edit profile	●
	Delete profile	●
	View profile list	●
Tenant Admin Management	Create Tenant Administrator	●
	Edit Tenant Administrator	●
	Delete Tenant Administrator	●
	View Tenant Administrator list	●

II. Tenant Administrator Permissions

Module	Operation	Tenant Administrator
User Management	Create user	●
	Edit user	●
	Delete user	●
	View user list	●
	Reset user password	●
Device Management	Create device	●
	Edit device	●
	View device details	●
	Manage device credentials	●
	Delete device	●
	View device list	●
Asset Management	Create asset	●
	Edit asset	●
	Associate asset with device	●
	Delete asset	●
	View asset list	●
Dashboard Management	Create dashboard	●
	Edit dashboard (add/configure widgets)	●
	Save draft	●
	Publish dashboard	●
	Share dashboard	●
	Delete dashboard	●
	View dashboard list	●
Rule Chain Management	Create rule chain	●
	Configure rule nodes	●
	Associate rule chain with device/asset	●
	Import rule chain	●
	Export rule chain	●
	Delete rule chain	○ (system root rule chain cannot be deleted; user‑defined can be deleted)
	View rule chain list	●
Alarm Management	Configure alarm rules	●
	View alarms	●
	Acknowledge alarms	●
	Clear alarms	●
Audit Logs	View audit logs	●
	Export audit logs	●

III. End‑User Permissions

Module	Operation	End‑User
Login & Personal Settings	Log in to the platform	●
	Log out	●
	Edit personal information	●
	Change password	●
Dashboard Viewing	View assigned dashboards	●
	View dashboard data (filter/refresh)	●
	Export dashboard data	●
	Create dashboard	○
	Edit dashboard	○
	Delete dashboard	○
Device Management	View assigned device information	○ (depends on widget configuration; no direct management permission)
Alarm Management	View alarms displayed on dashboards	●
	Acknowledge/Clear alarms	○ (depends on widget configuration)

Permission Comparison Summary

Functional Module	Core Operation	System Administrator	Tenant Administrator	End‑User
Login & Logout	Login/Logout	●	●	●
Tenant Management	Create/Edit/Delete	●	○	—
Tenant Profiles	Create/Edit/Delete	●	○	—
Tenant Admin Management	Create/Edit/Delete	●	○	—
User Management	Create/Edit/Delete	○	●	○
Device Management	Create/Edit/Delete	○	●	○
Asset Management	Create/Edit/Delete	○	●	○
Dashboard Management	Create/Edit/Delete	○	●	○
Dashboard Management	View assigned dashboards	—	—	●
Rule Chain Management	Create/Edit/Associate/Import/Export	○	●	○
Alarm Management	Configure alarm rules	○	●	○
Alarm Management	View alarms	○	●	●
Audit Logs	View/Export	●	●	○

Key Notes

• System Administrator: Has the highest platform privileges, responsible for tenant lifecycle management, system‑level configuration, and Tenant Administrator account management. Does not directly operate devices, assets, or dashboards within tenants.

• Tenant Administrator: Has full administrative privileges within a tenant, can manage all resources including users, devices, assets, dashboards, rule chains, and alarms. Tenant Administrators cannot view or modify data of other tenants.

• End‑User: Has restricted permissions, typically can only view specific dashboards assigned by the Tenant Administrator, and cannot create, edit, or delete dashboards. Other operation permissions, if needed, must be granted by the Tenant Administrator through widget configuration or dashboard sharing settings (e.g., exporting data via widget action configuration).

• Special Note on Rule Chain Deletion: The system root rule chain cannot be deleted; only rule chains customised by Tenant Administrators can be deleted. It is recommended to confirm that the rule chain is not associated with any device or asset before deletion.