Give your team and your customers access

Access in Witina comes from teams. A team holds a role in a context, and a context covers either your whole organization or one division, such as a customer. What someone can do at any moment depends on the context they’re working in. For the background, see People and access.

Everything on this page is under Organization Admin in the navigation.

Roles

Witina comes with built-in roles, marked System default:

Administrator: everything.
Viewer: read-only.
Operator: manages devices, credentials, and gateways, creates and runs changes, and restores device configurations.
Network Engineer: manages devices, credentials, and segments.
Infrastructure Admin: manages gateways, provisioning tokens, divisions, regions, contexts, and notification routing, and runs approved changes.
Regional Manager: manages divisions, regions, contexts, and their teams, and runs approved changes. Two more roles, MCP Read & Plan and MCP Read, Plan & Execute, are only for AI assistants connected to Witina, and aren’t offered for teams.

Opening a terminal or a device’s web interface needs the device:remote_access permission (“Open a terminal or web UI session on a device”), which Administrator, Operator, and Network Engineer include; see Remote access. Only Administrators can invite people.

The VPN has three permissions: vpn:read, which every built-in role includes, and vpn:update and vpn_session:read, which only Administrator includes. Who may connect through the VPN isn’t decided by roles but by VPN policies; see Set up the VPN.

Organization Admin → Overview lists exactly what each role grants. Built-in roles can’t be changed; to make your own, go to Roles and choose Create custom role, or Clone a built-in role and adjust it. You can only give a role permissions you hold yourself.

Invite someone

Go to Users and choose Invite user.
Enter their Email address and choose a Team. They get the roles that team holds. Optionally, choose a Default context for them to start in.
Choose Send invitation.

The invitation expires after 7 days. Resend restarts the 7 days, and Revoke cancels it.

Give a team a role

Roles are given to teams in a context:

Go to Contexts, open the context’s menu, and choose Manage teams.
Choose a Team and a Role, then Assign role.

To create a team, go to Teams and choose Create team. Add people with Manage members.

Limit a tech to certain customers

Create a team for the tech and add them to it.
For each customer they should work on, go to Contexts, open that customer’s context (“Customer Admin” if you onboarded them in Witina), choose Manage teams, and give the team a role.
Make sure they aren’t in any team that holds a role in your organization-wide context.

They can then work only with those customers’ regions, gateways, and devices.

Switch between customers

Switch context, in the top bar, lists every context where one of your teams holds a role. It’s available on wider screens.
On a customer’s page, Switch to this customer under Quick actions takes you into that customer’s context. It’s unavailable if you’re not in a team for that customer.

A customer’s own administrator

On the customer’s page, choose Invite an administrator, enter their email, and choose Send invitation. They join the customer’s Administrators team, with the Administrator role for that customer only. They see only that customer’s devices, gateways, and people.

Customers you added with Add existing division don’t have an Administrators team. Invite people for them from Users instead, choosing a team that holds a role in that customer’s context.

The organization’s owner

Being the owner grants no permissions of its own. The owner’s access comes from the Administrator role in the organization-wide context.
That context can’t be renamed or deleted, or left without an administrator.
To hand the organization to someone else, the owner goes to Organization Admin → General and chooses Transfer ownership under Owner. The new owner must already be a member. Transferring ownership needs a paid plan.