Access Groups

Access groups give a supplier, department, or production line its own slice of the organization: its stations, the test data those stations produce, and the members it works with. A station belongs to one access group, and a member can belong to many.

Creating, renaming, and deleting access groups requires the Admin or Owner role. Access groups are available on all plans.

What access groups scope

For a Viewer restricted to access groups, and for every Operator, access groups restrict:

• Stations: only the stations of their access groups, in every list, search and detail page, and in the Operator UI.
• Environment variables: only the organization's Config and Secrets, and those of the procedures and stations they can see.
• Procedures: only the procedures linked to those stations or run on them.
• Test data: only the runs produced by those stations, and the units, parts, batches, measurements, logs, attachments and analytics that come from those runs.
• Alerts: only the alerts on their groups' stations, never an alert without a station.
• Members and access groups: only the access groups they belong to, and the members of those groups, shown by name without their email address.

The same scope applies in the dashboard, the REST API and the MCP server. An API key carries the scope of the member who created it, read again on every request. Operators never read test data, whatever their access groups, because their role has no read access to it.

Restricted until an admin decides otherwise

What a new Viewer can see is set by the organization's access for new members. Adding a Viewer to an access group restricts them to their access groups. Removing them from their last access group, or deleting that group, never gives the whole organization back: they stay restricted and see nothing until an Admin or Owner assigns another access group or restores access to the whole organization. Widening someone's access is always a deliberate action, never the side effect of a removal.

Access for new members

In Settings > Members, Owners and Admins choose what a new member gets:

It applies to members added by SCIM or single sign-on, and it is the starting choice when you invite a member. If the chosen access group is deleted, the setting falls back to no access. Owners, Admins and Developers always see the whole organization.

Runs uploaded without a station

A run uploaded with a member's API key, or imported from a file, belongs to no station. It is visible to Owners, Admins, Developers and Viewers with access to the whole organization, and to no Viewer restricted to access groups. Upload from a station to make a run visible to an access group.

How visibility works

What a member sees depends on both their role and their access group assignments.

A station with no access group is visible to Viewers with access to the whole organization, and to no Operator or restricted Viewer.

Create an access group

You create access groups from the same screen you use for members.

The access group appears in the list, empty until you assign stations and members. Names are unique within the organization and can be up to 60 characters. There is no limit on the number of access groups.

Assign a station to an access group

Each station belongs to one access group, and changes take effect immediately.

The station, and every run it uploads, is now visible to that access group's Viewers and Operators, plus Owners, Admins, Developers and Viewers with access to the whole organization.

A station in an access group receives the same environment variables as any other station. The access group decides who may deploy to it: a Developer who belongs to access groups pushes builds and links procedures only to their groups' stations, creates stations inside one of their groups only, and cannot bring a station from outside their groups into one. Assigning an unassigned station to an access group needs the Developer role, but removing a station from its access group or moving it to another needs Admin or Owner.

Assign a member to an access group

Access group assignment only changes what Viewers and Operators see, but you can assign any member ahead of a role change.

Checking a first access group restricts a Viewer to their access groups. To give a Viewer back access to the whole organization, check Whole organization in the same menu and confirm. It is the only way to widen a Viewer's access.

You can also pick access groups directly when inviting a member.

Delete an access group

Deleting an access group does not delete its stations or members. Only the scoping link is removed: the group's stations become unassigned.