Roles & Access Control
Owner, admin, editor, lab editor, viewer, observer — and the admin portal.
Relevant for:Admin / Owner
Access follows a strict hierarchy — owner ⊃ admin ⊃ editor ⊃ viewer ⊃ observer — enforced on the server for every request, not just hidden in the UI. Lab Editor sits beside editor: the same design permissions, plus one extra grant.
| Owner | The master account (one per deployment, set at install). Everything an admin can do, plus role assignment — only the owner changes anyone’s role. Cannot be demoted or deleted. |
| Admin | Opens the Admin Portal: see all accounts and projects, create users (they start as editors), reset passwords. Role changes are reserved for the owner. |
| Editor (Operator) | Full product power — create, edit, validate, generate, publish. No visibility of other users. New sign-ups start here. |
| Lab Editor | Everything an editor can do, plus creating live labs on the lab host (lab.netforge.ai). The grant travels in the session token, so the lab service authorizes it without calling home. |
| Viewer | Read-only. The canvas renders but cannot be edited; configuration is visible but locked. |
| Observer | The restricted watch-only tier: topology is visible, but device configuration and IP addressing are hidden entirely. |
The Admin Portal#
Where to find itAvatar menu (top right)→Admin Portal
- Account list with per-user project counts; expandable to each user's projects.
- Set role on any account (admin / editor / lab editor / viewer / observer — never owner). Owner-only: admins see the badge but can't change it.
- Create accounts directly (for orgs that disable self-registration), reset passwords, delete accounts. Accounts an admin creates start as editors; the owner can pick any role at creation.
- Platform stats, analytics, self-test, and the visitor-metadata view.
Why
New users land as editors because the product is a design tool — a teammate who signs up should be able to build immediately, and read-only tiers stay available for the cases that need them. Role assignment concentrates with the owner so privilege escalation always has exactly one accountable gatekeeper. The observertier exists for the “super-admin who shouldn't see configs” case — auditors and executives can watch topology health without exposure to addressing or credential material. Role changes apply automatically — the app refreshes the session on the next page load (or when the user returns to an open tab); no re-login needed.
Note
The same role model serves the public SaaS and on-prem company installs — on-prem simply sets its own owner account and typically disables self-registration.
Important
The three privileged roles — owner, admin and lab editor— must have two-factor authentication enrolled; the app stays locked for such an account until it does, including immediately after a promotion. See Account & Security for the enrolment flow.