Access Control

Ordyn uses fixed roles and scoped user groups for normal access control.

Administrators do not create custom roles or assign individual permissions directly. Instead, Ordyn provides a fixed set of product roles. Each role grants a maintained set of product capabilities.

User Groups

Users receive access through user groups.

A user group can have one or more scoped role assignments. Each assignment combines:

• a fixed role
• a tenant
• optionally, a folder inside that tenant

When a folder is selected, the assignment applies to that folder and the resources below it. When no folder is selected, the assignment applies to the whole tenant.

Users

Users are managed from the user management area.

Administrators can:

• create users
• edit user display details
• assign users to user groups
• remove users that should not have access

Users without a role assignment can sign in, but they only see the limited access page because no product area is available to them.

When a user account is deleted, new automated work does not depend on that user account continuing to exist. Audit and history entries keep the recorded actor name for past actions.

Fixed Roles

Fixed roles are maintained by Ordyn and are updated with the product.

The available roles are:

Role	Purpose
Endpoint Viewer	Read endpoint and endpoint-group information.
Endpoint Operator	Operate endpoints and run common endpoint actions.
Job Operator	View, run, and abort jobs.
Job Designer	Create and maintain jobs, scripts, and supporting job assets.
Software Manager	Manage packages, software products, update policies, and software inventory reports.
OS Deployment Manager	Manage OS images, driver profiles, Ordyn releases, and enrollment assets.
AMT Viewer	Read tenant-scoped Intel AMT management state, evidence, inventory, events, operations, and session metadata.
AMT Operator	View and operate Intel AMT endpoints, including power, one-time boot, KVM, SOL, media, and own-session termination.
AMT Administrator	Manage tenant Intel AMT configuration profiles, provisioning, recovery, credentials, deprovisioning, and all tenant AMT sessions.
Hyper-V Operator	Collect Hyper-V VM inventory and operate VM power, snapshots, configuration, DVD media, and browser consoles.
Service Operator	Manage service clients and service infrastructure integrations.
Security Auditor	Inspect audit, history, configuration, and inventory data without operational mutation rights.
Access Manager	Create, update, and delete users; manage user groups and fixed-role assignments.
Platform Admin	Perform all normal permission-gated operations.

Fixed roles can be assigned to different tenants or folders through user groups. This allows the same role to grant broad access in one tenant and narrow access in another.

AMT job tasks require both a normal Jobs role and AMT Operator or AMT Administrator access for every target. Redirected media also requires access to the selected Ordyn file or OS image. Service Operator can administer tenant-owned AMT clients and activation credentials as well as global Relay service clients. Intel AMT infrastructure and Relay use separate permission families; neither grants tenant endpoint-control access.

Creating or importing a job or template with a configuration profile state task requires configuration profile read and update access. Manual runs require update access for every target endpoint. Schedules check every configured target when the schedule is created or updated, and trigger rules check their route scope when the rule is created or updated. Endpoint Operator supplies configuration profile read and update access; normal Jobs roles are still required for job authoring and execution. Self-service jobs use the access approved when the job was authored; the Windows user launching the job is not treated as an Ordyn operator.

Hyper-V operators also need Endpoint Viewer on the Hyper-V host scope so they can open the host and read its inventory. The Hyper-V Operator role supplies inventory collection, power and snapshot actions, VM and DVD modification, ISO insertion and ejection, and console access. These permissions are checked against the Hyper-V host even when an action is opened from a mapped guest endpoint.

Super Admin

Super admin access is separate from fixed roles.

A super admin bypasses normal role and scope checks. This is stronger than the Platform Admin role, which still works through the normal permission system.

Use super admin access only for trusted platform owners, initial setup, and break-glass recovery. For daily administration, prefer fixed roles assigned through user groups.

Practical Guidance

Use the smallest role and scope that match the user's work.

Examples:

• give helpdesk users Endpoint Operator on the folders they support
• give automation maintainers Job Designer on the tenants they manage
• give software owners Software Manager on their tenant
• give virtualization operators Endpoint Viewer and Hyper-V Operator on the folders containing their Hyper-V hosts
• give security staff Security Auditor when they need broad investigation access
• reserve Access Manager for people who administer users, user groups, and access assignments
• reserve super admin for people who must be able to recover or administer the whole platform