Permissions
There are three layers of permissions in udCloud: Organisation-level, Project-level, and Server-Wide Administration.
Organisations
Organisation permissions control what a member can do within an organisation. Every member has a set of permissions that can be granted individually or through Roles.
Default Roles
| Role | Description |
|---|---|
| Guest | Can see public projects in the organisation. No access to internal projects or member lists. |
| Member | Can see other members and internal projects. |
| Owner | Full access to everything in the organisation. Can rename the organisation, set its visibility, and promote other users to Owner. Owners always have all permissions regardless of individual permission settings. |
Available Permissions
Project Permissions
| Permission | Description |
|---|---|
| Manage Projects | Can create, delete and rename projects in the organisation. |
| View Projects | Can see projects exist. Without this, projects are hidden but the user may still access scenes or files with appropriate permissions. |
Member Permissions
| Permission | Description |
|---|---|
| Invite Members | Can invite new members to the organisation by email address, and approve or decline requests to join. |
| Remove Members | Can remove members from the organisation. |
| Modify Member Roles | Can add and remove roles from users (except Owner). |
| See Roles and Members | Can view the list of members and roles in the organisation. |
| Edit Roles | Can create and modify roles in the organisation. |
| Manage Joining | Can choose which email domains may join the organisation and create shareable invite links. This decides who is able to ask, which is why it is separate from Invite Members — approving an individual request needs that permission instead. |
Billing and Licence Permissions
| Permission | Description |
|---|---|
| View Billing Info | Can see the organisation's Licenses, Activity and Usage tabs — seat counts, holders, the allocation ledger, the activity record and egress usage. |
| View Billing Invoices | Can see purchase receipts and invoices, including historic ones. |
| Assign Licenses | Can assign the organisation's licence seats to members, and revoke them. |
| Purchase Licenses | Can buy additional licence seats for the organisation. |
See Licensing for what the tiers and seats are.
Roles
Roles are named collections of permissions that can be assigned to members. A member's effective permissions are the union of all their assigned roles plus any individually granted permissions. Permissions are additive — a role cannot revoke a permission granted by another role.
Roles can optionally be scoped to specific projects, limiting where those permissions apply.
See Roles in the Organisations guide for details on creating and managing roles.
Organisation Default Permissions
Organisations have a set of default permissions that are automatically granted to all members. These can be configured in the Organisation Settings page by an Owner.
Projects
File and scene permissions apply at the project level. A member's access to the contents of a project is determined by the permissions they hold for that project (either directly or through roles scoped to that project).
File Permissions
| Permission | Description |
|---|---|
| View File List | Can see the list of files in the project. |
| Stream Files | Can stream files from the project into udSDK applications (e.g. udStream), including files referenced in scenes. Streaming is free. |
| Download Files | Can download files from the project to local storage. Separate from streaming; organisation owners are charged for downloads. |
| Manage Files | Can upload, rename, move and delete files in the project, and create folders. |
| Configure File Settings | Can configure file storage settings for the project (e.g. connect an AWS S3 bucket, an Azure Blob container, or a local/network path). |
Two further file permissions exist in the data model but have no feature behind them yet, so they are not offered when editing a role: Archive Files and Share Files.
Scene Permissions
| Permission | Description |
|---|---|
| View Scene List | Can see the list of scenes in the project. |
| Read Scenes | Can load scenes in supported applications (e.g. udStream). |
| Edit Scenes | Can modify scenes in supported applications (save and collaborate). |
| Manage Scenes | Can create, upload, delete and rename scenes. |
| Share Scenes | Can share scenes with other members, and share them for preview so people with no account can open them. Sharing for preview also requires a Studio license; withdrawing it does not. See Scenes. |
Share Scenes is granted to members by default and is enforced by the server, but it is not offered as a tick-box when editing a role.
Work Item Permissions
| Permission | Description |
|---|---|
| View Work Items | Can see the work item list, individual items, their history and comments, and post comments. |
| Create Work Items | Can raise new work items. |
| Edit Work Items | Can edit work item fields and move items between the everyday states. |
| Assign Work Items | Can assign and unassign work items. |
| Manage Work Items | Can delete work items, and delete other members' comments. |
| Resolve Work Items | Can close items out and record how they ended. Deliberately separate from Edit — deciding something is finished is a different call from working on it. |
See Work Items.
Job Permissions
View Job List and Create Jobs exist in the data model, but jobs are not yet managed from the web interface, so these are not offered when editing a role.
Server Wide Administration
Server administrators have access across all organisations and users on the server instance. Opening the Admin console at all requires the Admin global permission on the account, and each section within it is gated by a further global permission — user administration, organisation administration, server configuration, analytics, backups and licence issuing are all separately grantable, so an administrator can be given only the areas they need.
Global permissions are assigned per user from the Admin console. For the full list and what each one grants, see the administrator guide's Admin Console page. Regular users do not have access to server-wide settings.