User Roles¶
Every DFACS user is assigned a role that controls what they can see and do. Roles are assigned by your DragonFly administrator when your account is created or updated.
Role Summary¶
| Role | Typical use |
|---|---|
| Viewer | Monitor-only — view doors, logs, and schedules |
| Operator | Day-to-day staff — unlock/lock doors, check access logs |
| Manager | Facility managers — full operational control including schedules and barcodes |
| Admin | Account administrators — manage users, tenants, and configuration |
| Billing | Finance/billing teams — access logs and reports only |
| Sales | Sales staff — instance and report visibility |
| Support | DragonFly support staff — diagnostics and system management |
| Superadmin | DragonFly internal use only |
Role Definitions¶
Viewer¶
Read-only access. Suitable for staff who need to monitor activity but not take action.
- View door status
- View access schedules
- View access logs
- View barcode database
Operator¶
Everything in Viewer, plus the ability to control doors.
- Unlock and lock doors
- View and search access logs
- View and search barcode database
Manager¶
Everything in Operator, plus schedule and barcode management. Recommended for facility managers.
- Manage access schedules (create, edit, delete)
- Manually open doors
- Search, export, and view statistics from access logs
- Manage denied barcodes
- View reports and instance health
Admin¶
Full control over the account, including users and configuration. Use for account owners or IT leads.
- Everything in Manager
- Manage users (invite, edit, assign roles)
- Manage tenants and domain configuration
- View and edit system configuration
- Push configuration to instances
- Test connectivity and restart application
- View system metrics, audit logs, and diagnostics
- Manage instances (assign, delete, sync, send commands)
- Manage onboarding
Billing¶
Designed for finance or billing teams who need usage data but not operational access.
- View access logs and statistics (across all instances)
- View and export reports
Sales¶
Designed for sales staff who need visibility into accounts.
- View access logs
- View and export reports
Support¶
For DragonFly support staff assisting clients. Includes diagnostic and system access.
- Door control (view, unlock, lock, manual open)
- View schedules
- View and export access logs across all instances
- View and search barcode database, manage denied barcodes
- View system configuration, metrics, logs, and diagnostics
- Manage and sync instances, send commands
- View reports and queue
- View onboarding status
Choosing a Role¶
When adding a new user, use the table below as a guide:
| Who is this user? | Recommended role |
|---|---|
| Front desk staff monitoring door activity | Viewer |
| Security or operations staff unlocking doors | Operator |
| Facility or gym manager | Manager |
| IT lead or account owner | Admin |
| Finance / billing team member | Billing |
If you're unsure, start with Viewer — it can always be upgraded later. Contact [email protected] if you need a role changed.
How Roles & Permissions Are Assigned¶
There are three ways to control what a user can do:
- Assign a built-in role — the quickest option; pick the role that fits (see the table above).
- Set specific permissions per user — toggle individual page/action permissions for one user.
- Create a custom role — build your own role with a custom set of permissions (for example, a "Front Desk" role that can view Access Logs but not open Configuration), then assign it to the people who need it.
Only Superadmin can manage other users' roles and permissions. On a local (on-device) installation, Superadmin is the built-in top-level account and stays local — it isn't created or synced from the cloud.
Cloud-Synced Users¶
If your installation is linked to the DragonFly Cloud Portal, users created in the portal are cached locally on the door computer, so they can still log in even if the connection to the cloud is temporarily down.
In the Cloud Portal, staff are added by invitation: an administrator sends an invite specifying the email, the target organization, and the role. The recipient clicks the emailed link, signs in (Google, Microsoft, or email + password), and their account is created with the role and organization you chose. Some accounts require two-factor authentication (2FA) at sign-in. See the Client Portal Guide and Multi-Location & Franchise for organization scoping.