Access control overview

ITVA controls what each person can see and change in your organization. This page explains the parts: administrators, roles, tags, and permissions. It also explains how ITVA uses them to decide what you can do.

Administrators and members

Each person in your organization has a membership. A membership is either an administrator, or a member with permissions.

Administrators can view and manage everything in your organization, including billing, users, and tags. ITVA does not apply permission checks to administrators. Only administrators can open Settings > Users.

Members can do only what their permissions allow.

A permission is a role plus tags

A member gets access through one or more permissions. Each permission has two parts:

• A role says what the member can do. For example, view devices, or manage credentials.
• Tags say which items the role applies to. For example, only the devices tagged site:london.

A member can have more than one permission, and ITVA adds them together. For example, a member can have a "Network operator" role for site:london and a "Read only" role for site:paris. That member can change London devices and only view Paris devices.

How ITVA decides what you can do

When you view or change an item, ITVA checks your access in this order:

1. If you are an administrator, ITVA allows the action.
2. If the item type is limited by tags, ITVA uses only your permissions that have at least one of the item's tags. If one of those roles allows the action, ITVA allows it.
3. If the item type is not limited by tags, ITVA uses all your permissions. If one of your roles allows the action, ITVA allows it.

These item types are limited by tags. Some items also get tags from the item they belong to:

Certificates and TLS applications have two more ways in. You can see a certificate from an enrollment that you own. If your role has View on Scans, you can also see the applications and certificates that your scans found.

All other item types use the role only, and tags do not limit them. For example, subnets, workflows, dashboards, tickets, and tags themselves.

Rules to remember

• If an item type in the table has no tags, only administrators can see it.
• A permission with no tags gives no access to the item types in the table. It still applies to all other item types.
• When you create one of these items, give it one of your tags. If you do not, you cannot see it after you save it. For a device, a folder with one of your tags is enough.
• If you remove a tag from an item, members who had access through that tag lose access to the item.

Where you set permissions

A user API key has no permissions of its own. It acts as the person who made it, with the same access.

To create roles and give them to people, see Roles and permissions. To create tags and add them to items, see Use tags.