Managing Roles & Permissions
On this page
Understanding RBAC in GCXONE
GCXONE uses role-based access control (RBAC) to determine exactly what each user can see and do. Every user must be assigned a role — without one, they land on a blocked screen immediately after login. Roles combine three things: the modules they can access, the actions they can perform within each module, and which customers and sites they can operate on.
The Role Management Screen
Navigate to Settings → Roles. The Role Management screen lists every role in the tenant with user counts and actions.
Creating a Custom Role
Navigate to Settings → Roles → Configure New Role.
Step 1 — Role Information
Enter the role Name and Description.
Name roles specifically — it's more useful in audit logs than "Operator 2".
The role wizard opens with Role Information. Name the role specifically.
Step 2 — Users
Select which users should be assigned to this role from the searchable user grid. Use Select All, Remove All, or search to manage the list in bulk.
Step 3 — Module Privileges
Work through each platform module in the left panel, grouped into Core, Feature, and System. Grant or remove specific capabilities per module — Dashboard, Configuration, Video Activity Search, Marketplace, Camera Actions & Alarm Handling, Talos, and more.
Each module has granular capabilities. The Configuration tab controls adding customers and editing device credentials — Admin only.
Step 4 — Entity Access
Set which customers, sites, and devices this role can operate on. Enable Include Children on any parent to auto-include all sub-entities — including future additions.
Entity Access Modes
No Entity Access
Users assigned this role get no entities by default. Assign entities per user afterward via Edit Entity Access. Best for a shared role where each user needs a different set of customers or sites.
Selected Entities
Assign specific customers and sites. Enable Include Children to auto-include any sub-entities added in future.
Selected Entities mode with Include Children toggle.
Full Access
Role sees every customer and site in the tenant. Use only for internal admin accounts.
Full Access mode. Use only for internal admin accounts.
Role Configuration Reference
- Super Admin — All modules. Entity: Full Access.
- Admin — Dashboard, Configuration, User Management, Roles & Permissions, Reports. Cannot access billing.
- Operator — Configuration (view-only), Camera Actions & Alarm Handling, Dashboard, HealthCheck, ZenMode, Video Activity Search, Map, Video Viewer. No Settings, Talos, Marketplace, or Genie access.
- Installer — Configuration (Devices, Sensors, Network Settings), Video Viewer (Live). Cannot manage users or roles.
- End User — Dashboard, basic Configuration view, Reports, Video Viewer (Live), Arm/Disarm for assigned devices. No ability to change settings.
Per-User Entity Access Override
Customize entity access for an individual user without creating a separate role. This is where Override and Merge mode — the two ways to layer a user's own entities on top of their role — come in:
- Navigate to Settings → Roles → Edit Entity Access and select the user from the list — or, for a shortcut straight to one user, go to Settings → Users, open their Actions menu, and choose Edit User Entities.
- Choose Override or Merge mode.
- Add or remove specific customers, sites, or devices.
- Save — the change applies immediately.
Post-Migration Role Recovery
User Sees Access Denied on a Module They Had Before
- Open their role → Module Privileges → verify the capability was not removed during the role edit.
- Check Audit Log → filter by user and date.
User Cannot See a Recently Added Site
- Check if their role uses Selected Entities without Include Children.
- Either enable Include Children on the parent customer, or manually add the new site to the role.
User Has Access to Sites They Should Not
- Check for active Merge overrides on the user.
- Navigate to Settings → Roles → Edit Entity Access.
- Remove the unwanted Merge entries.
Related Resources
- For the conceptual overview of RBAC, roles, and entity access, refer to Understanding Roles & Permissions
- For the full catalog of every individual permission, refer to Privileges
Thank you — your feedback goes to the team that owns this page.