Overview

Navixis uses a hierarchical system of permissions at 3 levels:

1. Access to the organization : Owner, Administrator, Member

2. Access to sites : Manager, Can Edit, Read Only

3. Access to equipment : Manager, Can Edit, Read Only

Each level defines what a user can see and do in the application.

Level 1: Access to the organization

Owner

What it can do:

✅  Manage all users in the organization (invite, modify roles, delete)

✅  Assign the owner role to others users

✅  Access all sites and equipment without restriction

✅  Change all organization settings

✅  Delete organization

Who should have this role:

– Founder of the organization

– General manager

– Senior IT Manager

Administrator

What it can do:

✅ Manage member users (invite, modify, delete)

✅ Manage sites and equipment

✅ Access configuration features

✅ Create and edit events

✅ View all reports and data

What he can't do:

❌ Assign the owner role

❌ Edit or delete owners

❌ Delete organization

Who should have this role:

– Technical manager

– Project manager

– Department manager

Hierarchy :Owner > Administrator > Member

Member

What it can do:

✅ Consult the data of the sites to which he has access

✅ Use applications according to your site permissions

What he can't do:

❌ Invite other users

❌ Edit organization configuration

❌ Manage other users

Who should have this role:

– Standard user

– External consultant

– Observer

Important: The real rights of a member depend on its permissions at the site level.

Level 2: Access to sites

Administrator

What it can do:

✅ Completely manage the site and its subsites

✅ Manage all site equipment

✅ Invite users to this specific site

✅ Edit site configuration

✅ Access all site data

✅ Create and manage site events

Who should have this role:

– Site manager

– Facility manager

– Building manager

Can edit

What it can do:

✅ Edit site data

✅ Edit equipment

✅ Create and edit content

What he can't do:

❌ Invite users

❌ Delete site

❌ Edit advanced configuration

Who should have this role:

– Technician

– Maintenance agent

– Field operator

Hierarchy :Manager > Can Edit > Read Only

Read only

What it can do:

✅ View site data

✅ View equipment and their condition

✅ View reports

What he can't do:

❌ Edit anything

❌ Create equipment

❌ Access configuration

Who should have this role:

– Listener

– External consultant

– End customer (read only)

– Observation intern

Level 3: Access to equipment

Equipment rights follow the same logic as the sites:

Equipment Manager

✅ All rights to the equipment

✅ Can configure and configure

✅ Can send commands

Can modify equipment

✅Can change basic settings

✅ Can send some commands

❌ Limited access to configuration advanced

Read only on equipment

✅ Can view data

❌ No modification possible

How rights combine

Rights are combined according to a cascade logic: the highest level higher always wins.

Example 1: Owner with limited access to a website

Situation : Marie is the owner of the organization. She has a read-only access to Site A.

Result : Marie has full access everywhere, including Site A. The “read only” is ignored because proprietary > read only.

Example 2: Member with site management specific

Situation : Jean is a member of the organization (no global rights). He is manager of Site B.

Result : Jean can't do anything at the organizational level, but he has all the rights to Site B and its subsites. Ideal for a manager site without access to the rest of the organization.

Important Safety Rules

Rule 1: Protection of the owner

An administrator can never modify or delete a owner. Only an owner can manage a other owner.

Rule 2: You can only give what you have

A user can only assign lower roles or equal to his own:

– An admin can create members, but not owners

– A site manager can provide access to “can modify” " or "read-only", but not "manager »

Rule 3: Inheritance of subsites

Rights on a parent site apply automatically to all its subsites:

– If you are the manager of “Building A”, you are manager of all floors of the Building A

– A subsite can never have more rights than its parent

Concrete use cases

Case 1: New business starting

Installation steps:

1. An owner is created (the founder)

2. The owner invites administrators (responsible for departments)

3. Administrators invite members to their sites respective

Case 2: Property management company multi-site

Organization :XYZ Property Management Company

Team :

– Owner: General Manager (sees everything, handles everything)

– Administrator: Technical manager (manages technicians and sites)

Building A:

– Manager: Main caretaker (manages the building)

– Can modify: Maintenance technicians (intervene)

– Read only: Residents (consult their consumption)

Building B:

– Manager: Senior Guardian

– Read only: Residents

Case 3: Temporary external service provider

Context :An external technician intervenes on certain sites

Configuration:

– Organization: Member (no global rights, no access to the rest)

– Building A: Can modify (can intervene and do its job)

– Building B: Read only (can consult for diagnosis)

Advantage :The service provider is isolated and has no access only what he needs.

Permission Levels

Organization

Site

Standard Profiles

Main Pages

1. Sites

2. Equipment

3. Network

4. Events

5. Data

6. Users

Applications

ENERGY – Energy management

PROTECT – Security, interventions, maintenance

SHOU – Indoor air quality (CO₂)

EMA – EvaluationMeans Ventilation

SKY – DataPollutants

POSE – Interventions and planning

PPMS – Alarm and event management

Permission Hierarchy

General Structure

The Navixis platform uses a permissions system two levels: Organization and Site.

Organization Level Permissions

Site Level Permissions

Hierarchy Rules

1. Premium organization on site

The Owner and Administrator roles at the level Organization systematically overrides Site permissions. An Owner or Administrator has access total even if it is only Read-only on a site given.

2. Inheritance of Site Permissions

A user with Manager permission on a parent site automatically gets Manager on all child sites and descendants.

Example: Parent Site (Manager) → Child Site 1 (inherits Manager) → Grandchild Site (inherits Manager)

3. Maximum Permission Applied

When a user has different permissions on a parent site and a child site, this is the most common permission high which applies for each site individually.

Example: A member with Read Only on the Parent Site and Manager on the Child Site will have Manager rights only on the Children's Site, and Read only on the Site Parent.

4. Conflict Resolution

Concrete Examples

Example 1: Site Manager

User :John Dupont

– Nexelec Organization: Member

– Site “Building A”: Manager

– Site “Floor 1”: Manager (inherited)

– Site “Floor 2”: Manager (inherited)

Possible actions:

Yes :Create, modify and delete equipment on Building A, Floor 1 and Floor 2

Yes :Manage users of these sites

Yes :Delete schedules

No :Access other organization sites

No :Manage organization members

Example 2: Multi-Site Technician

User :Mary Martin

– Nexelec Organization: Member

– Site “Building A”: Can modify

– Site “Building B”: Can modify

– “Building C” site: Read only

On Building A and B:

Yes :Create and modify equipment, modify and apply the schedules

No :Delete equipment or schedules, manage them users

On Building C:

Yes :View data and export reports

No :Any modification

Example 3: Organization Administrator

User :Pierre Administrator

– Nexelec organization: Administrator

– No explicit site permission

Possible actions:

Yes :Access to all sites, create/modify/delete any equipment, manage all users, create new sites, all actions on all sites

Special Cases

API keys

API keys have independent permissions. users:

– May be limited to certain sites

– May have specific permissions (read only, writing)

– Do not follow organization/site hierarchy

– Defined when creating the key

Standard Profiles

Standard profiles apply combinations predefined:

Important Notes

Inheritance of permissions:Permissions of a parent site are inherited by child sites.

Hierarchy :Read only < Can edit < Manager