Roles & Permissions
Understanding RBAC roles and what each role can access
Last updated: 2026-05-21
Roles Overview
S3Suite uses Role-Based Access Control (RBAC) to manage what each user can see and do. Every user is assigned one role within their organization. Roles control two things independently: which areas of the app you can open at all, and which actions (read, write, delete) you can take inside those areas.
Available Roles
| Role | Description |
|---|---|
| Org Admin | Full control over the organization, users, settings, and all data |
| Engineer | Engineering, manufacturing handoff, BOM, firmware, test, vendors, AI assistant |
| Production Manager | Manufacturing variants, production lots, devices, vault, vendors, AI assistant |
| Operations | Deployed devices, warranty, RMA, support, knowledge base, AI assistant |
| Viewer | Read-only access to engineering, manufacturing, and operations |
Areas Each Role Can Access
This is the canonical map of which app areas each role can open. If your role does not have access to an area, the sidebar hides it and direct navigation redirects you back to the dashboard.
| Area | Org Admin | Engineer | Prod Manager | Operations | Viewer |
|---|---|---|---|---|---|
| Engineering Suite (per project) | Yes | Yes | - | - | Read |
| Manufacturing Suite (per project) | Yes | Yes | Yes | - | Read |
| Operations Suite (per project) | Yes | - | - | Yes | Read |
| Vendors | Yes | Yes | Yes | - | - |
| Square AI Assistant | Yes | Yes | Yes | Yes | - |
| Knowledge Base | Yes | Yes | Yes | Yes | - |
| Support Tickets (unassigned inbox) | Yes | Read | Read | Read | - |
| Project-level Settings + Tokens | Yes | Yes | - | - | - |
| Org-wide Settings | Yes | - | - | - | - |
| Audit Trail | Yes | - | - | - | - |
Note: Engineers can access project-level settings (file security, device tokens) but not the org-wide Settings page where users, modules, and email config are managed.
Capability Matrix
Inside the areas above, the actions a role can take are further constrained. The Viewer role is always read-only.
| Capability | Org Admin | Engineer | Prod Manager | Operations | Viewer |
|---|---|---|---|---|---|
| Organization & Users | |||||
| Manage team members | Yes | - | - | - | - |
| Update org settings | Yes | - | - | - | - |
| Configure email / modules | Yes | - | - | - | - |
| Projects | |||||
| Create / update projects | Yes | Yes | - | - | - |
| Delete / archive projects | Yes | - | - | - | - |
| Project Diary | Yes | Yes | - | - | Read |
| Engineering Suite | |||||
| Upload docs, firmware, schematics | Yes | Yes | - | - | Read |
| Create / edit test templates | Yes | Yes | - | - | - |
| Delete test templates | Yes | - | - | - | - |
| Manufacturing Suite | |||||
| Create / update variants | Yes | Yes | Yes | - | - |
| Delete variants | Yes | - | - | - | - |
| BOM, lots, devices | Yes | Yes | Yes | - | Read |
| Operations Suite | |||||
| Devices, RMA, warranty, OTA | Yes | - | - | Yes | Read |
| Knowledge Base | |||||
| Read entries | Yes | Yes | Yes | Yes | - |
| Create / edit entries | Yes | Yes | Yes | Yes | - |
| Delete entries | Yes | - | - | - | - |
| Support Tickets | |||||
| Read unassigned inbox | Yes | Yes | Yes | Yes | - |
| Route / assign tickets to projects | Yes | - | - | - | - |
| Vendors | |||||
| Read vendor directory | Yes | Yes | Yes | - | - |
| Create / edit vendors | Yes | - | - | - | - |
| Device Tokens (project) | |||||
| Read tokens | Yes | Yes | - | - | - |
| Create / rotate / reveal | Yes | Yes | - | - | - |
| Delete tokens | Yes | - | - | - | - |
What Square AI Sees
Square AI follows the same role boundaries. When a user opens Square, the assistant is only allowed to retrieve and analyze the data their role can access. For example, an Operations user asking Square about a returned device gets answers drawn from RMAs, warranty, support tickets, knowledge base, and device telemetry - but never from internal BOM or vendor records. See AI Assistant for the role scope details.
Assigning Roles
- Go to Settings > Users
- Find the user in the team members table
- Use the role dropdown to change their role
- Confirm the change in the confirmation dialog
Note: Only Org Admins can change user roles.
Super Admin
The Super Admin is a platform-level role with its own separate login at /admin. Super Admins can:
- View and manage all organizations
- Enable premium features per organization
- Configure AI API keys (OpenAI, Anthropic)
- Manage the approved vendor directory
Important: Super Admin access is separate from regular app authentication. It uses a different token and login page.