User Roles & Permissions
LEXOH's role-based access control (RBAC) system allows you to define granular permissions for different user types. This guide explains how to create, manage, and assign roles effectively.
📋 Understanding Roles
A role is a collection of permissions that determine what actions a user can perform in the LEXOH system. By default, LEXOH includes three pre-configured roles:
👤 Technicien
Field technicians who install and maintain devices. Limited access to configuration.
⚙️ Administrateur
System administrators with full access to settings, users, and devices.
🎛️ Opérateur
Daily operators who monitor systems and respond to events. View and control access.
➕ Creating a New Role
Step 1: Access Roles Management
- Navigate to Paramètres (Settings) in the sidebar
- Click on Rôles in the settings menu
- Click the + Ajouter un rôle button in the top right
Step 2: Configure Basic Information
Nom du rôle (Role Name)
Enter a descriptive name for the role (e.g., "Security Manager", "Parking Attendant", "Maintenance Staff")
Restreindre aux étiquettes (Restrict to Labels)
Optional: Limit this role's access to devices with specific labels. Useful for multi-site deployments.
Restreindre aux entreprises (Restrict to Companies)
Optional: For multi-tenant systems, restrict role to specific organizations.
Step 3: Configure Permissions
Expand each permission category and toggle the switches to grant or deny access:
Utilisateurs (Users)
- • Peut voir les utilisateurs
- • Peut ajouter des utilisateurs
- • Peut modifier les utilisateurs
- • Peut supprimer les utilisateurs
Alertes (Alerts)
- • Configurer les droits sur les alertes
Véhicules (Vehicles)
- • Configurer les droits sur les véhicules
Caméras (Cameras)
- • Configurer les droits sur les caméras
🔐 Permission Categories
LEXOH organizes permissions into logical categories. Here's a complete breakdown:
👥 User Management
| Permission | Description |
|---|---|
| users.view | View user list and details |
| users.create | Create new user accounts |
| users.edit | Modify existing user information |
| users.delete | Remove user accounts from the system |
🚪 Access Control
- View door status and access logs
- Remotely control doors (open/lock)
- Manage access credentials and cards
- Configure access schedules
📹 Video Surveillance
- View live camera feeds
- Review recorded footage
- Control PTZ cameras
- Configure camera settings
- Manage video recordings
🅿️ Parking Management
- View parking occupancy and status
- Control parking barriers
- Process parking payments
- Configure parking rates
- Generate parking reports
🔔 Alerts & Notifications
- View system alerts
- Acknowledge and dismiss alerts
- Configure alert rules
🚗 Vehicle Management
- View vehicle registry
- Register new vehicles
- Edit vehicle information
- Remove vehicles from registry
✏️ Editing Existing Roles
- Go to Paramètres → Rôles
- Find the role in the list (Opérateur, Administrateur, Technicien, etc.)
- Click the blue pencil icon in the Actions column
- Modify the role name, restrictions, or permissions
- Click Enregistrer (Save) to apply changes
👤 Assigning Roles to Users
Once roles are configured, assign them to users:
- Navigate to Paramètres → Utilisateurs
- Click on a user to edit, or create a new user
- In the user form, find the Rôle dropdown
- Select the appropriate role (Technicien, Administrateur, etc.)
- Save the user profile
✨ Role Management Best Practices
1. Follow Least Privilege Principle
Grant users only the minimum permissions needed to perform their job. Start restrictive and add permissions as needed, rather than starting with full access.
2. Use Descriptive Role Names
Name roles based on job function, not individual names. ✓ "Building Manager", ✗ "John's Role"
3. Limit Number of Roles
Keep roles between 3-8 for most organizations. Too many roles become difficult to manage and audit.
4. Regular Audits
Review role assignments quarterly. Remove access for departed employees and adjust permissions for role changes.
5. Document Role Purpose
Maintain documentation explaining what each role is for and who should be assigned to it. This helps with onboarding and compliance.
6. Test Before Production
Create test users with new roles to verify permissions work as expected before assigning to real users.
📝 Common Role Examples
Security Guard
Permissions:
- View doors and access logs
- Control doors remotely
- View live camera feeds
- View and acknowledge alerts
- View vehicle registry
- NO user management or configuration
Parking Attendant
Permissions:
- View parking occupancy
- Control parking barriers
- Process payments
- View vehicle registry
- Register new vehicles
- View parking cameras
Building Manager
Permissions:
- View all devices and systems
- Generate reports
- Configure parking rates
- Manage access schedules
- View all alerts and logs
- NO system configuration or user management
IT Administrator
Permissions:
- Full system configuration access
- User and role management
- Device configuration
- Network and integration settings
- System maintenance
- Database and backup management
🗑️ Deleting Roles
To delete a role:
- Ensure no users are currently assigned to the role
- Go to Paramètres → Rôles
- Click the red trash icon for the role
- Confirm deletion in the popup dialog
🔧 Troubleshooting Role Issues
User Can't Access Features
- Verify the user's assigned role includes the required permission
- Check if role is restricted to specific labels or companies
- Ask user to log out and log back in after role changes
- Clear browser cache if permission changes aren't reflecting
Can't Delete Role
- Ensure no users are currently assigned to the role
- Cannot delete system default roles (Administrateur, Technicien, Opérateur)
- Reassign users to different roles before attempting deletion
Permission Changes Not Working
- Users must log out and log in for permission changes to take effect
- Verify you saved the role changes after editing
- Check server logs for permission validation errors
- Confirm role is not being overridden by label or company restrictions
Ready to Configure Roles?
Start by reviewing your organization's access needs and creating appropriate roles
