Roles and permissions

Every user has two kinds of role:

An organization role — Administrator or Member. It decides whether the user can manage the organization itself: its workspaces, users, routers, security policy and API clients.
A workspace role in each workspace they belong to — Viewer, Operator, Manager or Admin. It decides what the user can do inside that workspace. Someone can be a Manager in one workspace and a Viewer in another.

Organization roles

Role	What it allows
Administrator	Everything in Organization Settings: workspaces, users, routers, time zone, security policy (including service provider access) and API clients. An organization administrator also has full Admin rights in every workspace of the organization, whatever workspace roles are listed for them.
Member	Nothing at organization level. What a member can do comes entirely from their workspace roles.

In short:

Viewer — looks. Sees everything in the workspace and changes nothing in it. A Viewer can choose their own email notifications.
Operator — runs the site day to day. Everything a Viewer can do, plus: open remote access to instruments and suppress alarms.
Manager — sets the workspace up. Everything an Operator can do, plus: create, edit and delete locations, devices, tags, alarms, metrics and shared views, edit gates and reprocess samples.
Admin — full access to everything in the workspace. For the screens in this manual, an Admin can do the same as a Manager.

Area by area (✓ = allowed):

Area	What	Viewer	Operator	Manager	Admin
Dashboard	View the dashboard	✓	✓	✓	✓
Devices	View devices, their status and error history	✓	✓	✓	✓
	Open remote access to an instrument		✓	✓	✓
	Create, edit, change the state of and delete devices			✓	✓
Locations	View locations	✓	✓	✓	✓
	Create, edit and delete locations			✓	✓
Tags	View tags	✓	✓	✓	✓
	Create, edit and delete tags			✓	✓
Metrics	Plot metrics, export metric data, use views	✓	✓	✓	✓
	Share a view with the workspace; edit or delete shared views			✓	✓
	Add, edit and remove metrics; resolve pending metrics; delete aliases			✓	✓
Flow cytometry	Review samples, export results and FCS files	✓	✓	✓	✓
	View gates and the gate library	✓	✓	✓	✓
	Edit a gate, hand-gate a sample, rename or archive gates			✓	✓
	Apply a gate to history (reprocess samples); stop a regate			✓	✓
Alarms	View alarms and what triggered them	✓	✓	✓	✓
	Suppress an alarm		✓	✓	✓
	Create, edit, enable, disable and delete alarms			✓	✓
Notifications	Read notifications	✓	✓	✓	✓
	Choose your own email notifications	✓	✓	✓	✓
Workspace Settings	The Settings gear; change tags, metrics and gates			✓	✓
Organization Settings	Workspaces, users, routers, time zone, security, API clients

Organization settings are not part of any workspace role — only the organization role Administrator gives access to them.

Give each person the lowest role that lets them do their job:

People who only need to look at results — lab staff, management, auditors: Viewer.
People who look after the site and the instruments day to day: Operator.
The people who set up and maintain the workspace — locations, devices, alarms, gates: Manager. Keep this group small; Managers can delete things.
Admin adds nothing a Manager cannot do on the screens in this manual. Reserve it for the one or two people who own the workspace.
Make someone an organization Administrator only if they must manage users, workspaces, routers or security. It gives full rights in every workspace.