Roles & Permissions

AndroidNexus uses a role-based access control (RBAC) system to manage what team members can see and do within the platform. This guide explains the available roles and their permissions.

Overview

When you invite team members to your organization, you assign them a role that determines their level of access. AndroidNexus uses a two-tier role system:

1. Organization Roles - Assigned when inviting members (Owner, Admin, Viewer)
2. Platform Roles - Automatically mapped from organization roles to control API access

Organization Roles

These are the roles you see when managing team members in Settings.

Owner

The organization owner has complete control over the account.

• Full access to all features and settings
• Can manage billing and subscription
• Can invite and remove any team member
• Can delete the organization
• Cannot be removed (ownership must be transferred)

Admin

Administrators have full operational access.

• Full access to all features and settings
• Can manage team members (invite, change roles, remove)
• Can configure integrations (AMAPI, etc.)
• Can manage organization settings
• Cannot manage billing or delete organization

Viewer

Viewers have read-only access to devices and policies. This role has no write access anywhere in the platform.

• Can view devices and device logs
• Can view policies (read-only)
• Can view groups
• Cannot execute device commands (lock, wipe, etc.)
• Cannot create or manage enrollment tokens
• Cannot create, edit, or delete policies or groups
• Cannot access organization settings
• Cannot configure integrations
• Cannot manage team members

Permission Matrix

Feature	Owner	Admin	Viewer
Dashboard
View dashboard metrics	Yes	Yes	Yes
View alerts	Yes	Yes	Yes
Acknowledge alerts	Yes	Yes	No
Devices
View devices	Yes	Yes	Yes
Execute commands	Yes	Yes	No
Manage enrollment tokens	Yes	Yes	No
View device logs	Yes	Yes	Yes
Assign users to devices	Yes	Yes	No
Policies
View policies	Yes	Yes	Yes
Create/edit policies	Yes	Yes	No
Delete policies	Yes	Yes	No
Assign policies	Yes	Yes	No
Groups
View groups	Yes	Yes	Yes
Create/edit groups	Yes	Yes	No
Delete groups	Yes	Yes	No
Settings
View organization settings	Yes	Yes	No
Edit organization settings	Yes	Yes	No
Manage team members	Yes	Yes	No
Configure integrations (AMAPI)	Yes	Yes	No
View billing	Yes	No	No
Manage billing	Yes	No	No
Audit & Compliance
View audit logs	Yes	Yes	No
View auth events	Yes	Yes	No

Role Mapping Details

When you assign an organization role, it maps to internal platform roles:

Organization Role	Platform Role	Description
Owner	admin	Full platform access
Admin	admin	Full platform access
Viewer	device_manager	Read-only access to devices, policies, and groups

Why Viewers Can't Access Settings

Viewers are intentionally restricted to read-only access across the platform, including organization settings. This ensures that users who only need visibility into devices, policies, and groups can't accidentally modify organization-wide configuration, integrations, or device state.

If a viewer needs to take action (execute device commands, manage enrollment tokens, edit policies, etc.) or needs settings access, an admin should upgrade their role to Admin.

Changing Roles

Admins and Owners can change team member roles:

1. Go to Settings > Team Members
2. Find the member in the list
3. Click the role dropdown next to their name
4. Select the new role

Role Change Effects

• Upgrading to Admin: User immediately gains access to settings and integrations
• Downgrading to Viewer: User loses access to settings on their next page load

Inviting Team Members

To invite a new team member:

1. Go to Settings > Team Members
2. Click the Invite Member button
3. Enter their email address
4. Select their role (Admin or Viewer)
5. Click Send Invitation

The invited user will receive an email with instructions to join your organization.

Best Practices

Principle of Least Privilege

Assign the minimum role needed for each user's job function:

• IT Help Desk Staff - Admin role, since resolving tickets typically requires executing device commands (lock, wipe, reset password, etc.), which Viewer cannot do
• MDM Administrators - Admin role (full management)
• Security Auditors / Read-only Stakeholders - Viewer role (monitoring devices, policies, and groups without the ability to make changes)

Regular Access Reviews

Periodically review team member access:

• Remove members who no longer need access
• Downgrade roles if elevated access is no longer required
• Audit admin accounts to ensure they're still necessary

Separate Accounts for Different Functions

If you need both operational and administrative access:

• Use your Viewer account for day-to-day monitoring of devices, policies, and groups
• Use your Admin account when you need to execute device commands, manage enrollment tokens, or make configuration changes

Troubleshooting

"Access Restricted" Error on Settings Page

If you see this error, your account has the Viewer role which doesn't have settings access.

Solution: Contact your organization's Admin or Owner to either:

• Upgrade your role to Admin, or
• Have them make the settings changes on your behalf

Can't Invite Team Members

Only Admin and Owner roles can invite new members.

Solution: Ask an existing Admin or the Owner to send the invitation.

Can't See Audit Logs

Audit logs are restricted to Admin and Owner roles for security reasons.

Solution: If you need audit access for compliance purposes, request an Admin role upgrade.

Related Topics

• Settings Overview - General settings configuration
• Quick Start Guide - Getting started with AndroidNexus
• Best Practices - Security and operational guidelines