Access Control Concepts

GAP is a multi-tenant platform.

Data is stored in a central repository, separated by logical identifiers using the concept of tenants.

Tenants

A tenant is a container for GAP data - this includes users, devices, geofences, rules and event other tenants.

Tenants act as security boundaries and are organised into a hierarchy. Think of it as trees in a forest, with branches and leaves but no shared roots.

The root tenant in each hierarchy is called the top-level tenant. Child tenants are called sub-tenants.

Once created, tenants cannot be moved to other places in the tenant hierarchy. We recommend designing your tenant structure prior to implementation and keeping it as simple as possible.

See Managing Tenants for more information.

Users

A user represents a person with some level of access to GAP.

A user account resides in a tenant. By default, users in a sub-tenant cannot view objects in a parent tenant (unless that object has been specifically shared with them).

A user also cannot see data in tenants at the same level in the tenant hierarchy as their own.

See Managing Users for more information.

User Roles

The role assigned to a user account determines the functionality that user can access. It also is a factor in determining the objects (e.g. devices, users, etc.) that the user can access.

There are two built-in roles:

• User - has limited permissions (e.g. can view only devices assigned to them).

• Administrator - has the ability to view and manage all objects in their tenant and any sub-tenants.

See Managing User Roles and User Roles Reference for more information.

Collections

More complex access control requirements can be met through the use of collections.

A collection comprises devices, groups of devices and / or tenants. These collections are assigned to users, who are in turn granted access to them.

See Managing Collections for more information.