Members and roles
Learn the difference between organization and network roles, who can do what, how to invite and add people, and what removal does.
nixscale has two layers: the organization (your company) and the networks inside it. People join the organization by invite and are added to networks separately. That's why there are two kinds of roles.
Roles
Organization roles
| Role | Who |
|---|---|
| Owner | The organization's owner. Can do everything; only owners can grant or remove the owner role. |
| Admin | An admin on every network in the organization. Invites people, creates networks, manages roles. |
| Member | Only sees and uses the networks they're assigned to. |
Network roles
When someone with the Member organization role is added to a network, you choose their role on that network:
| Role | On this network, they can |
|---|---|
| Admin | Manage devices, labels, people groups, rules and members. |
| Member | Add and delete their own personal computer; use the access rules give them. |
Who can do what?
| Action | Owner | Organization admin | Network admin | Member |
|---|---|---|---|---|
| Rename the organization | ✓ | — | — | — |
| Invite people to the organization | ✓ | ✓ (can't invite as owner) | — | — |
| Change organization roles | ✓ | ✓ (can't touch the owner role) | — | — |
| Remove people from the organization | ✓ | ✓ (can't remove an owner) | — | — |
| Create networks | ✓ | ✓ | — | — |
| Networks they can see | All | All | Assigned | Assigned |
| Add members to a network, change network roles, remove from a network | ✓ | ✓ | ✓ | — |
| Manage labels, people groups and rules | ✓ | ✓ | ✓ | — |
| Approve shared networks (routes) | ✓ | ✓ | ✓ | — |
| Add their own personal computer | ✓ | ✓ | ✓ | ✓ |
| Add a device for someone else, or a machine | ✓ | ✓ | ✓ | — |
| Delete devices | All | All | All | Only their own |
These permissions are enforced on the server; a button missing in the panel is just a reflection of the rule.
Invite someone to the organization
Open the People tab
On the organization's page, go to the People tab.
Send the invite
Type the address in Email, choose the Role and click Send invite.
- An invite email goes to that address. The invite is valid for 14 days and appears under Pending invites, where you can Cancel it.
- The person must sign in with the same address and accept the invite: you can send them the Accept an invite guide.
- Pending invites count toward the number of people in your plan.
- To send invites, your own email address must be verified. To prevent abuse, an organization can send at most 20 invites in 24 hours.
Add someone to a network
People with the organization Member role need to be added to a network before they can use it.
Open the form
On the network page, go to Members and click Add member.
Choose the person and role
Pick the person in Person and their network role in Role, then click Add to network.
The list only shows people with the organization member role who aren't on this network yet. The person you add gets an email explaining how to connect their device.
Change roles
- Network role: change it with the role menu on the person's row in the network's Members section.
- Organization role: change it with Role on the person's row in the organization's People tab.
The person whose role changes is notified by email.
Remove someone
From a network
Click Remove on the person's row in the network's Members section. The confirmation dialog lists the effects before anything happens. The person stays in the organization.
From the organization
Click Remove on the person's row in the People tab. The person is removed from every network in the organization.
What removal does
| What happens | Details |
|---|---|
| Their personal computers are signed out | The devices stay as Access revoked; delete them so they don't use up your limit. |
| Unused enrollment keys are revoked | Keys created for or by the person stop working. |
| They're removed from people groups | The groups' rules no longer apply to them. |
| Labeled devices keep their access | Devices they enrolled that later got a label are machines and don't leave with the person. Delete them separately if needed. |
The removed person is notified by email.
Removal isn't possible in some cases: the organization's founder can't be removed, the only owner can't be removed, admins can't remove an owner, and nobody can be removed from the organization while one of its networks is suspended.
Who gets an email, and when?
| Event | Recipient |
|---|---|
| Invited to the organization | The invited address |
| Invite accepted | The person who sent it (if still in the organization) |
| Added to a network | The person added |
| Organization or network role changed | The person whose role changed |
| Removed from a network or the organization | The person removed |
| Signed in for the first time with a verified email | The person signing in (welcome email) |
| An admin created a device key on someone's behalf | The device's owner |
| A personal device was deleted | The device's owner |
| A personal device was given a label (now a machine) | The person who enrolled it |
Nobody gets an email for an action they took themselves.