User Roles & Access

Onboard uses role-based access control to manage what users can see and do within your organization. This guide explains the default roles, how multiple roles combine, and how to create custom roles for specific buildings.

👥 Default Roles

Every organization includes the following default roles:

Org Admin: Full control of the organization. Org Admins can access all buildings and deployments, launch and manage them, and manage users in their organization.
Org Manager: The same access to buildings, deployments, and pages as an Org Admin, without user management.
Org Viewer: Read-only access. Org Viewers can view and export data, but cannot launch or manage buildings and deployments, and cannot make changes.
Sandbox Viewer: Read-only access to Onboard's Sandbox buildings.
- Sandbox buildings are synthetic buildings created by Onboard so new users can explore how data flows through Onboard. Users with the Sandbox Viewer role can view and export the data for these buildings. Sandbox access is always read-only. Org Admins can add or remove this role for any user in the organization.

🔐 Role Comparison

Capability	Org Admin	Org Manager	Org Viewer
Launch & Manage Deployments/Buildings	✅	✅	❌
Model Building Data	✅	✅	❌
User Management	✅	❌	❌
Explore Live Building Data & Monitor Trends	✅	✅	✅
Export Time-Series Data	✅	✅	✅
Onboard Data Model	✅	✅	✅
API Access	✅	✅	✅
Set-up Data Alerts	✅	✅	✅
Multi-Factor Authentication	✅	✅	✅
Set Unit Preferences	Organization level	User level	User level

API access carries the permissions of the user who created them, so an API key created by an Org Viewer is read-only.

🧩 Custom Roles

Custom roles let Org Admins grant access to specific buildings instead of the whole organization. Org Admins can create them from the Roles tab on the User Management page.

Choose a role template such as Admin or User
- Admin Access to specific buildings: Create, Read, Update, and Delete permissions as you choose, applied to the selected buildings.‍
- User Access to specific buildings: Read-only permissions on the selected buildings
You can name the role and its description.
- E.g. Admin Access to Building X or Read Only Access to Buildings X & Y
Select the buildings the role applies to.
Select permissions: Create, Read, Update, and Delete. You can choose some or all.

Permissions apply across the building workflow.