Skip to main content
NearNode uses a four-tier RBAC model. Every workspace member has exactly one role. Permissions are enforced at both the UI and API level — there is no client-side-only access control.

​
Role Hierarchy

​
Permission Matrix

​
Role Descriptions

​
Owner

Full control over the workspace. Can manage billing, transfer ownership, and delete the workspace. There is exactly one Owner per workspace.

​
Admin

Full CRUD access to all resources. Can manage team members (invite, change roles, remove) except the Owner. Cannot manage billing or delete the workspace.

​
Editor

Can create and modify nodes, routing rules, and write NFC tags. Cannot delete nodes, manage batches/templates, or access workspace settings. Ideal for field operators and content managers.

​
Viewer

Read-only access to all resources. Can view nodes, analytics, write logs, and batches but cannot modify anything. Ideal for stakeholders, clients, and auditors.

​
Changing a Member’s Role

1

Open Members

Navigate to Settings → Members.
2

Select Role

Click the role badge next to the member’s name. Select the new role from the dropdown.
3

Confirm

Role changes take effect immediately. The member’s active sessions are updated without requiring re-login.
Admins can change the roles of Editors and Viewers, but cannot promote themselves to Owner or demote another Admin. Only the Owner can manage Admin-level role changes.

​
API Enforcement

RBAC is enforced server-side on every API request. An API key inherits the permissions of the user who created it. If a key’s creator is later downgraded to Viewer, the key can only perform read operations.
Use scoped API keys to further restrict access beyond role-level permissions. A scoped key can never exceed its creator’s role permissions.