# Roles

Each user has exactly one role per tenant.

Roles define what a user can see and do inside the selected tenant. A user may have different roles in different tenants, but never more than one role in the same tenant at the same time.

## Create a Role

Navigate to *Engineering -> Roles*.

{% @supademo/embed url="<https://app.supademo.com/demo/FbyUVm0B-hzWFp2LFv5o6>" demoId="FbyUVm0B-hzWFp2LFv5o6" fullWidth="true" %}

## Configure a Role

The following settings can be configured in a role:

* **Name**: The name of the role.
* **Location**: Defines the default map section for users with this role.
* **Expert Mode**: Allows access to related entities such as tickets or digital twins even if the linked asset itself is not directly visible.
* **Used in Tenants**: Shows in which tenants this role is currently in use.
* **Tags / Asset Tags**: Restricts access to tagged assets.
* **Full Access to Assets Without Tags**: Grants access to assets that have no tags.
* **Permissions by area**: Read and write access for the available areas such as Dashboards, Widgets, Alarms, Assets, Analytics, Reports, Smart Views, Map and Floor, BIM, Connections, Engineering, and other enabled modules.
* **Users in Other Lists**: Allows users, under certain conditions, to see the names of other users in relevant lists.
* **Manage**: Where available, allows copying supported objects such as dashboards, analytics, reports, or smart views to other users.

{% hint style="info" %}
If you deactivate a universal switch, the corresponding menu item is hidden for users with this role.
{% endhint %}

{% hint style="info" %}
It is not possible to have write permission without read permission.
{% endhint %}

### Expert Mode

When Expert Mode is activated, related entities can still be visible even if the underlying asset is outside the user's normal asset visibility.

This is useful when users need to work with tickets, digital twins, or similar objects that reference assets with restricted access.

### Asset Tags

If you add one or more tags to a role, users with this role can only access assets that carry at least one of those tags.

Example: If you add the tag "Ventilation systems," the role can only access assets that are tagged with "Ventilation systems."

{% hint style="warning" %}
If an asset has multiple tags, access is granted as soon as at least one of those tags is permitted for the role.
{% endhint %}

### Full Access to Assets Without Tags

If this option is activated, users with this role have full access to assets that do not carry any tags.

### Users in Other Lists

This option allows users, in supported cases, to see the names of other users in lists even when they would otherwise not see them.

## Assign a Role to a User

{% @supademo/embed url="<https://app.supademo.com/demo/oukZv4RR6w0t7GGGkoFUS>" demoId="oukZv4RR6w0t7GGGkoFUS" fullWidth="true" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.buildings.ability.abb/collection/mandatory-base/platform-core/workspace-and-identity/roles/tenant-roles.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.