Managing Member Permissions

This guide walks you through inviting people into your organization, giving each one the right standing, and tuning exactly which plants and portfolios they can reach. You manage all of it from one place — the Team tab — and you never need to touch individual rights one by one.

Two layers decide what a member can do. Their organization role sets a default standing across everything your organization owns, and an optional job role on a single plant or portfolio raises or lowers that default for one resource. For the full model behind these layers, see the Permission System. This guide stays on the tasks.

Open in Mirox

Manage your team from Organization ▸ Team — the link opens your organization on the Team tab directly. (Inviting and changing roles is open to Admins and Moderators — see the rule below.)

Inviting a Member

When you invite someone, they receive an email, register an account, and join your organization with the role you chose. The whole flow is self-service for them — see Onboarding for the new-member side, and Invitations for the three invitation types.

On the Team tab, select Invite.
Enter the person's email address.
Choose their organization role (see the table below).
Pick the language the invitation email is sent in.
Select Send Invitation.

The new entry appears in the team list marked Invited until they accept. You can filter to just pending invites with the list dropdown (Internal / External / Invited / All), and re-send an invitation from a member's actions menu if it expires.

Choosing the Organization Role

The role you pick is the member's default standing across the organization. Each role also maps to a default job role on every plant your organization owns.

Organization Role	What it gives	Default per-plant authority
Admin	Manages everything — members, cooperations, billing, all resources.	Operator (full management)
Moderator	Manages members, cooperations and resources alongside the Admin; only deleting the organization stays with the Admin.	Operator (full management)
Asset Manager (Technical)	Technical asset manager: plant configuration, components, events and tickets, remote access to the plant networks; sees the team but does not manage it.	Technical Manager
Asset Manager (Commercial)	Commercial asset manager: the same plant, event and ticket handling plus contracts, billing, revenue and tariffs — but no remote network access and no team management.	Asset Manager
Member	Standard read access to the organization's resources.	Viewer (read-only)
External	No default access; reaches resources only through explicit grants.	None — assign per resource

The organization's report templates, chapters and metrics, its Data Export templates and its Alert Manager rules, receivers and templates are created and changed by Admins, Moderators and both Asset Manager roles; Members use them. See Permission System.

Inviting an External

External members get no access until you grant it. After you send an External invitation, Mirox immediately opens the permission dialog so you can grant them a job role on the specific plants or portfolios they need. You also give an External a short label (for example "Maintenance Contractor") to identify them in the team list.

Who Manages the Team

Membership is governed by Admins and Moderators only.

Admins and Moderators invite members and grant any role — a Moderator may invite or promote a new Admin.
The two Asset Manager roles, Members and Externals see the team but cannot invite anyone, change a role, pause a membership or hand out plant permissions. The managers run the plants; the team itself is run by the tiers above them.

Admins and Moderators are also the only ones who create, accept, pause or end a cooperation. Only they set the organization's security policy.

Granting a Job Role on a Specific Plant or Portfolio

A member's organization role already gives them a sensible default everywhere. Grant a per-resource job role only when you want to raise or lower that default for one plant or portfolio — for example, giving an External read access to a single park, or letting a Member act as Technical Manager on one plant. A direct grant always overrides the inherited default.

On the Team tab, open the member's actions menu (the ⋮ button on their row) and select Edit Permissions.
Choose the resource type — Portfolio or Park.
Select the specific portfolio or park from the list.
Choose the job role to grant:
- Viewer — read-only access to the resource's data and metrics.
- Technical Manager — technical authority: configuration, components, events and tickets, plus remote access to the plant's networks.
- Asset Manager — commercial authority: the same configuration, event and ticket handling, plus revenue and tariffs — no remote network access.
- Security Officer — the plant's network segments only (network infrastructure, cameras, security systems) and its access log; no production or commercial data. See Network Segmentation.
- Client — the plant's own operating data, live and historical: production, battery, turbines, analysis, the dashboard, the forecast and market prices. No events, tickets, reports, exports, contacts or money, and no push notifications for the plant. Meant for a plant's customer or principal: invite them as External and grant Client on their plant — a Member with a Client grant keeps the Member's Viewer access.
Optionally set an expiration date for the grant (it never expires by default).
Select Add Permission.

The grant takes effect immediately and is listed under Current Permissions, where you can renew its expiration or remove it later.

Granting on a Portfolio vs a Park

A grant on a portfolio applies to every park inside it; a grant on a single park refines access for that park only. Assign at the highest level that fits, and refine at the park level only for genuine exceptions. See Resources & Hierarchy for how the hierarchy flows.

Capped for Shared Resources

For a plant shared with you through a cooperation, you can only delegate up to the role the owning organization shared — typically Viewer plus the single shared role. You cannot grant a member more authority on a shared plant than your organization received.

Pausing a Member or Setting an Expiry

You can temporarily suspend a member without removing them, set their whole membership to expire on a date, or change their organization role — all from one dialog.

On the Team tab, open the member's actions menu and select Edit Role.
Adjust any of the following, then Update:
- Role — change their organization role (Admins and Moderators only — see above).
- Membership active — turn this off to pause the member. A paused member keeps their seat and grants but is blocked from all access until you switch it back on. Paused members show a Paused badge in the list.
- Membership expiration — set a date on which their access ends automatically. Useful for fixed-term contractors and externals.
- Contract administrator — Admins only: allows this member to sign the framework agreement and project-company accessions and to assign plants on the Subscription page. Not available for External members. See Contracts.

Expiry at Two Levels

Membership expiration (in Edit Role) ends the member's whole organization standing. A per-resource grant can carry its own expiration (in Edit Permissions) that ends access to just that plant or portfolio. Use whichever scope matches the engagement.

Removing Access

On the Team tab, open the member's actions menu and select Remove Member.
Confirm in the dialog.

Removal takes the member out of the organization and revokes their access. This cannot be undone — if you only need to suspend someone temporarily, use Membership active instead. Every assignment and removal remains traceable; see the Audit Log.

Verifying What a Member Can Reach

Before relying on a configuration, confirm it. Open a member's row to review their current organization role, any per-resource grants, and any expirations in one place. When in doubt, grant the narrowest role that does the job and widen later — least privilege keeps access easy to reason about.

Two-Factor Authentication and Plant Access

A role is not always enough. If an organization requires two-factor authentication (2FA) for plant access, a member without a second factor (authenticator app or passkey) does not see that organization's plants, whatever role you granted. So when a member reports missing plants, ask first whether 2FA is enabled on their account. Each member enables 2FA on their own profile — see Setting Up Two-Factor Authentication.

You set the requirement on the Security tab. Once the rule is announced, the tab shows how many of your members still have no second factor — see Setting Your Organization's Security Policy.

Permission System — the full role model behind organization and job roles
Invitations — the three invitation types and how people join
Creating Cooperations — share specific plants with a partner organization
Setting Your Organization's Security Policy — sign-in durations and the 2FA requirement for your plants
Resources & Hierarchy — how access flows down organizations, portfolios, and parks
Audit Log — who accessed which plant devices and when
Onboarding — the end-to-end path a new member follows to reach first data