Access Groups
Last updated on July 20, 2026
Access groups scope which Stations and Runs a member sees. A station belongs to one access group, but a member can belong to many.
How visibility works
Access group scoping interacts with roles, so what someone sees depends on both their role and their access group assignments.
| Role | Sees |
|---|---|
| Owner, Admin, Developer | Every access group's stations and runs. |
| Viewer (no access groups) | Every access group's stations and runs, read-only. |
| Viewer (assigned to access groups) | Only those access groups' stations and runs. |
| Operator | Only stations in the access groups they are assigned to. |
Create an access group
You create access groups from the same screen you use for members.
Open Settings > Members and scroll to Access Groups.
Click Create access group and name it.
The access group appears in the list, empty until you assign stations and members.
Assign a station to an access group
Each station belongs to one access group, and changes take effect immediately.
Open Stations and select the station.
Pick an access group from the dropdown in the station settings.
Save. The station is visible to that access group's Viewers and Operators, plus Owners, Admins, and Developers.
A station with no access group assignment is visible to every Viewer and to no Operator.
Assign a member to an access group
Access group assignment for members only matters for Viewers and Operators, but you can assign it ahead of time for anyone.
Open Settings > Members and find the member.
Click the actions menu and select Manage access groups.
Check and uncheck access groups, then save.
Access group assignment only matters for Viewers and Operators.
Delete an access group
Deleting an access group does not delete its stations or members. Only the scoping link is removed.
Open Settings > Members and find the access group.
Click the actions menu, select Delete, and confirm.
Stations in the access group fall back to organization-wide visibility, and members lose access-group-restricted access.
How is this guide?
Access Roles
Learn how the five TofuPilot access roles control what every member can read and write, and how access groups layer on top to scope visibility.
Single Sign-On
Learn how to authenticate every TofuPilot member through your identity provider with SAML 2.0 or OIDC, so credentials never live on TofuPilot.