Roles and permissions

Overview and explanation

Predefined roles

Roles provide ready-made permission sets for common jobs such as Company advertising management, server administration or super administration.

• Company Ad Manager: Manage media and campaigns within your own Company, including the relevant operational reports.
• Central Ad Manager: Manage advertising content across Companies within the assigned scope.
• Company admin: Manage your own Company, its users, content, locations and devices within this preset’s scope.
• Server admin: Manage users, content and devices across Companies; this preset does not automatically grant permission to change server configuration.
• Super admin: The broadest preset, including server and licence management.

A preset is a starting set of permissions, not a guarantee of unrestricted access. The administrator’s permissions limit both the available presets and the resulting rights. Check the matrix after selecting a preset and save the changes.

Granular permissions

Each area can then be adjusted with View / Add / Edit / Delete permissions, for example allowing content editing while disabling deletion.

Server Edition scope

Standard users work inside their own Company. Server Edition can additionally grant access outside the user’s own Company. A server administrator who must manage all customer Companies needs both the relevant role/functional permissions and the appropriate cross-Company scope.

Recommendation

Start with the closest predefined role, then remove permissions the user does not need. Apply the principle of least privilege to deletion permissions and server-wide access scope.

How to design permissions in practice

First decide what the user needs to do, then for which Company, and only then assign individual permissions. Do not grant broader access simply because it is easier to configure.

Typical scenarios

• Content manager: needs media, campaigns and possibly applications, but does not necessarily need device service administration.
• Local operator: limit access to the Company and actions required for day-to-day operation.
• Technical administrator: add the permissions needed for devices, monitoring and service operations.
• White-label / Server Edition administrator: set scope according to whether the user manages one or multiple Companies.

Check after creating the user

1. Assign the role or granular permissions.
2. Verify the Company scope.
3. Have the user sign in and confirm that the required administration areas are visible.
4. If something is missing, add the specific permission rather than unnecessarily broadening the whole role.

Why a preset role may be unavailable

Available permission presets depend on the signed-in administrator’s rights. Administrators do not automatically see every preset or gain the ability to grant rights beyond their own. Ask an authorised administrator if a required preset is missing. Editing a user’s details and editing their permissions are separate rights.

Managing access in practice

• User details: check the login name in the user detail and edit the display name if you have permission.
• Permission changes: editing user details and managing permissions are separate rights. Select an available preset role, check the individual areas and Company scope, then save.
• Removing access: revoke permissions or delete the user if authorised. Resetting a password does not replace revoking permissions.
• Verification: After a change, we recommend signing in again and checking the available functions.