Access Groups
Last updated on August 20, 2026
Access groups scope which stations a member sees, so you can give a supplier, department, or production line its own slice of the organization. A station belongs to one access group, and a member can belong to many.
Creating, renaming, and deleting access groups requires the Admin or Owner role. Access groups are available on all plans.
What access groups scope
Access groups restrict station visibility: the station list, station detail pages, and the stations shown in the Operator UI.
Other test data is not group-scoped: runs, units, parts, batches, and analytics remain organization-wide for every role that can read them. Operators never see this data regardless of grouping, because their role has no read access to it.
How visibility works
What a member sees depends on both their role and their access group assignments.
| Role | Stations they see |
|---|---|
| Owner, Admin, Developer | All stations. |
| Viewer (no access groups) | All stations, read-only. |
| Viewer (assigned to access groups) | Their access groups' stations, plus stations with no access group. |
| Operator (assigned to access groups) | Only their access groups' stations. |
| Operator (no access groups) | No stations. |
A station with no access group is visible to every Viewer and to no Operator.
Create an access group
You create access groups from the same screen you use for members.
Open Settings > Members and scroll to Access Groups.
Click Create access group and name it.
The access group appears in the list, empty until you assign stations and members. Names are unique within the organization and can be up to 60 characters. There is no limit on the number of access groups.
Assign a station to an access group
Each station belongs to one access group, and changes take effect immediately.
Open Stations and select the station.
Pick an access group from the dropdown in the station settings and save.
The station is now visible to that access group's Viewers and Operators, plus Owners, Admins, and Developers.
Assign a member to an access group
Access group assignment only changes what Viewers and Operators see, but you can assign any member ahead of a role change.
Open Settings > Members and find the member.
Click the actions menu and select Manage access groups.
Check and uncheck access groups, then save.
You can also pick access groups directly when inviting a member.
Delete an access group
Deleting an access group does not delete its stations or members. Only the scoping link is removed: the group's stations become unassigned.
Unassigned stations are visible to every Viewer and to no Operator. Deleting an access group immediately cuts its Operators off from its stations, and exposes those stations to all Viewers. Reassign the stations to another access group first if that is not what you want.
Open Settings > Members and find the access group.
Click the actions menu, select Delete, and confirm.
How is this guide?
Access Roles
Learn how the five TofuPilot access roles control what every member can read and write, and how access groups layer on top to scope visibility.
Managing Members
Learn how to invite users, change roles, and remove members from your TofuPilot organization while keeping their test data traceable.