Boss’nX role capabilities: action rights and logs scope

In Boss’nX, the Capabilities section of a role defines the actions allowed to its accounts: sending commands, managing components, acknowledging alarms, editing scenarios, managing accounts or roles. It also sets the Logs scope, that is, the logs these accounts can view.

Intended for the administrator or installer authorized to manage roles. Accessible components are set in the scope standing rules, hidden datapoints in the datapoint tag rules and alarm emails in the Notifications section.

Before you start

• Your role has the Manage roles capability.
• You have checked the role and its associated accounts: the change applies to every account that uses this role.

Open the role’s capabilities

1. Open the relevant supervision, then Menu → Users, Roles tab.
2. Click Edit on the role’s row.
3. In the editor, select Capabilities if this section is not already open.
4. Read the banner, if any.

The capabilities of a system role or of a shared default role are read-only. A default role specific to one supervision may offer editable capabilities: rely on the controls and the banner displayed. If the section is read-only, have the administrator check which role to use.

Enable the capabilities you need

Each row is a switch: click the row to enable or remove the capability. The green slider indicates an active capability. The category counter also includes capabilities enabled automatically by another one.

Category	Capabilities offered
Building & Components	Send commands, Manage components, Manage topology, Manage BACnet, Manage Modbus
Alerts	View alarms, Acknowledge alarms, Delete alarm history
Schemas	View schemas, Edit schemas
Scenarios	View and run scenarios, Operate scenarios, Edit scenarios
Monitoring & Notifications	View analytics
Network health	View network health, Manage network health
Dashboard	Edit own dashboard
Administration	View accounts, Manage accounts, Manage roles
Logs	View activity logs, Manage logs

Read the description shown under each capability before granting it. For example, Manage components concerns their configuration, while Delete alarm history concerns alarm events. The Monitoring & Notifications category does not configure emails: they are set in the role’s Notifications section.

The accessible pages also depend on the context: the same capability, for example on accounts, does not necessarily give the same pages in a supervision and in the hypervision.

Understand a capability enabled automatically

The chain icon and auto · enabled by… indicate that another capability enables this one. The dependent row then cannot be edited directly.

Enabled capability	Capabilities associated automatically in the editor
Manage components	Send commands
Acknowledge alarms	View alarms
Delete alarm history	Acknowledge alarms and View alarms
Edit schemas	View schemas
Operate scenarios	View and run scenarios
Edit scenarios	Operate scenarios and View and run scenarios
Manage network health	View network health
Manage accounts	View accounts
Manage roles	Manage accounts and View accounts
Manage logs	View activity logs

To remove a dependent capability, first disable the capabilities that impose it, then check its own row: it stays active if it had been chosen separately. Check each final state before saving.

Grant all current and future permissions

All permissions — current and future enables all capabilities and automatically enables, for this role, new features added later. In this mode, the individual switches appear active and are unavailable.

This mode sets neither the accessible building, nor the datapoint rules, nor the notifications. The Allowed widgets and Logs scope refinements remain adjustable when the role is editable; for the first one, follow the allowed widget types.

Disabling this mode restores the individual capability choices kept previously. It does not reset the widget and logs scope choices: check them separately.

Choose the viewable logs

When View activity logs is active, directly or automatically, Logs scope appears under this capability. Select one of the options:

Option	Viewable logs
All logs	The general scope offered
Only logs from this user’s account	The logs of the account viewing them
Only logs from authorized components	The logs tied to the authorized components

This choice applies to the Activity log page and the history panels. It does not select components in Components & Building. If View activity logs and the capabilities that impose it are removed, the setting disappears from the section; check it again when you re-authorize logs.

Save without losing your own rights

Editing your own role can remove your ability to manage it. Before removing Manage roles or the all-permissions mode, make sure another administrator will be able to take over management. If a warning announces the loss of your own rights, cancel and prepare this change with that administrator.

1. Review the switches, the logs scope and any other sections you changed.
2. Click Save in the bottom bar. Saving covers the whole role, not only Capabilities.
3. Wait for Role updated and the return to the list.

Discard restores the whole editor to its loaded state, without leaving the page. Back to roles asks you to abandon unsaved changes before leaving; declining to leave keeps your input.

Check the result

1. Reopen the role and check the capabilities and logs scope kept.
2. Have the users concerned open a new session.
3. With one of these accounts, check the expected pages and actions in the supervision or the hypervision, as well as the accessible logs.

Troubleshooting

• Save absent: check that you changed a value and that the role is editable.
• Save disabled: read the warnings of the role’s other sections.
• Refusal or interrupted response: note the message and check the reloaded state before a new attempt.
• Logs scope cannot be found: enable View activity logs or a capability that imposes it.
• An expected access is missing for an account: check the supervision, the role assigned to the account and your own rights.

If the rights remain inconsistent, contact support@can-nx.com with the supervision, the role, the expected action and the checks performed, without sending any access secret.

French labels: Menu → Utilisateurs → Rôles → Modifier → Capacités, Toutes les permissions — actuelles et futures, auto · activé par…, Périmètre des logs, Tous les logs, Uniquement les logs du compte de l’utilisateur, Uniquement les logs des composants autorisés, Journal d’activité, Enregistrer, Annuler les modifications, Rôle mis à jour.