HelioFleetDocs

Roles & permissions

A tenant has two roles. That's it - no custom roles, no per-feature toggles. The distinction is broad on purpose: admins run the tenant, users use devices.

The two roles#

Admin#

Tenant admins can do everything inside the tenant. They see every workspace, every device, and every user, regardless of workspace assignment.

What admins can do that users cannot:

  • Manage users - invite new people, change workspace assignments, delete accounts.
  • Manage workspaces - create, describe, delete workspaces.
  • Organize leased devices - assign them to workspaces so the right people see them.
  • See analytics - tenant-wide usage across people, devices and workspaces, plus the session log.
  • Handle billing - start / upgrade / cancel a subscription, view invoices.
  • See admins-only notifications - e.g. a device pulled for maintenance.

User#

Tenant users are workspace-scoped. They sign in, see the devices they have access to, and run sessions.

What users can do:

  • See devices in workspaces they're a member of.
  • Lock and control devices they can see - full single-device and dual-device control.
  • Manage apps already on a device - launch, stop, uninstall.
  • See notifications addressed to the whole tenant (admins-only notifications are filtered out).
  • Change their own password.

The Admin tab in the top navigation doesn't appear for users.

Workspace visibility#

Workspace filtering only applies to users - it's invisible to admins. See Workspaces explained for the model; the short version:

  • Admin → sees every workspace and every device.
  • User → sees only devices in workspaces they're a member of.

A user assigned to zero workspaces sees an empty Devices page even if the tenant is full of devices. Assign them at least one workspace and the relevant devices appear.

The same applies from the other side: a newly leased device belongs to no workspace until you place it, which makes it admin-only. Assign each new device to at least one workspace - see Managing devices.

Changing roles#

Roles are set at invite time and not editable in place. To change a user's role, delete them from Admin → Users and re-invite with the new role. Their workspace assignments are not preserved - you'll re-pick those when they accept.

Quick reference#

Both roles can:

  • See devices - admins see every device in the tenant; users see devices in their workspaces only.
  • Control devices - single and dual control, on any device they can see.
  • Manage apps already on a device (launch, stop, uninstall).

Admin only:

  • Invite and delete users.
  • Create and delete workspaces.
  • Assign devices to workspaces.
  • See analytics (tenant-wide usage across people, devices and workspaces, plus the session log).
  • Handle billing (subscription, invoices).
  • Receive admins-only notifications (e.g. a device pulled for maintenance).