Team & Settings
Roles & Permissions
Pointeron uses a role-based access control system to manage what each team member can see and do within an organization. Roles follow a hierarchy, and Pro and Enterprise plans unlock custom permission groups for fine-grained control.
Role hierarchy
Pointeron defines four built-in roles arranged in a strict hierarchy:
Owner > Admin > Manager > Member
Each higher role includes all the permissions of the roles below it. A Manager can do everything a Member can, an Admin can do everything a Manager can, and so on.
Owner
The Owner has unrestricted access to every aspect of the organization. There is exactly one Owner per organization.
Owner-exclusive capabilities:
- Billing and subscription -- Change plans, update payment methods, view invoices, cancel subscription.
- Organization settings -- Rename the organization, change timezone, configure notification defaults.
- Delete organization -- Permanently remove the organization and all associated data.
- Transfer ownership -- Assign the Owner role to another team member. This demotes the current Owner to Admin.
Note
Ownership transfer is the only way to change the Owner. You cannot promote a team member to Owner -- the current Owner must explicitly transfer the role from Settings > Organization > Transfer Ownership.
Admin
Admins have full operational control over the organization without access to billing or destructive organization-level actions.
Admin capabilities include:
- Team management -- Invite new members, remove existing members, change roles (except Owner).
- Asset and device management -- Create, edit, delete, and assign assets and devices.
- Geofence management -- Create, edit, and delete geofences. Configure alert rules and notification triggers.
- API keys -- Generate, rotate, and revoke API keys. Configure key scopes and rate limits.
- Webhooks -- Create, edit, test, and delete webhook endpoints.
- Reports and analytics -- Access all reports, export data, configure scheduled reports.
Admins cannot:
- Manage billing or subscription settings
- Delete the organization
- Transfer ownership
Manager
Managers have day-to-day operational access for managing tracking resources. This role is ideal for fleet supervisors, field coordinators, or team leads.
Manager capabilities include:
- Assets -- Create, edit, and delete assets. Assign and reassign devices.
- Devices -- View device status, configure tracking settings, manage device pools.
- Geofences -- Create, edit, and delete geofences. Set up alert rules and notification preferences.
- Alerts and notifications -- Configure alert rules, view alert history, manage notification channels.
- Reports -- View reports and analytics dashboards.
Managers cannot:
- Invite, remove, or modify team members
- Manage API keys or webhooks
- Access organization settings
Member
Members have read-only access to the organization. This role is suited for stakeholders, clients, or team members who need visibility without the ability to make changes.
Member capabilities include:
- Live Map -- View real-time asset positions, click markers for details.
- Assets and devices -- View asset listings, device status, and assignment details.
- Geofences -- View geofence boundaries on the map.
- Alert history -- View past alerts and notifications.
Members cannot:
- Create, edit, or delete any resources (assets, devices, geofences, alerts)
- Access settings, API keys, webhooks, or team management
Permission matrix
| Capability | Owner | Admin | Manager | Member |
|---|---|---|---|---|
| View live map and assets | Yes | Yes | Yes | Yes |
| View alert history | Yes | Yes | Yes | Yes |
| Create/edit/delete assets | Yes | Yes | Yes | -- |
| Create/edit/delete geofences | Yes | Yes | Yes | -- |
| Manage devices | Yes | Yes | Yes | -- |
| Configure alert rules | Yes | Yes | Yes | -- |
| View reports and analytics | Yes | Yes | Yes | -- |
| Export data | Yes | Yes | -- | -- |
| Manage API keys | Yes | Yes | -- | -- |
| Manage webhooks | Yes | Yes | -- | -- |
| Invite/remove team members | Yes | Yes | -- | -- |
| Manage billing | Yes | -- | -- | -- |
| Organization settings | Yes | -- | -- | -- |
| Delete organization | Yes | -- | -- | -- |
| Transfer ownership | Yes | -- | -- | -- |
Permission groups
Plan requirement
Permission groups are available on Pro and Enterprise plans.
Beyond the four built-in roles, Admins and Owners can create custom permission groups for fine-grained access control. Permission groups let you tailor access to specific needs without being constrained by the role hierarchy.
How permission groups work
- Navigate to Settings > Permissions and click Create Group.
- Name the group (e.g., "Fleet Manager", "API Developer", "Regional Viewer").
- Select the individual permissions to include in the group.
- Save the group.
- Assign the group to one or more team members from the team management page.
A user can have multiple permission groups assigned simultaneously. Permissions are additive -- if a user has two groups, they receive the combined permissions of both.
Example groups
| Group name | Included permissions | Use case |
|---|---|---|
| Fleet Manager | Assets (full), Geofences (full), Alerts (full), Reports (view) | Supervisors managing vehicles and zones |
| Regional Viewer | Assets (read), Map (view), Alerts (view) | Stakeholders monitoring a specific region |
| API Developer | API keys (full), Webhooks (full), Assets (read) | Engineers building integrations |
| Report Analyst | Reports (full), Assets (read), Data export | Team members focused on analytics |
Custom permissions per user
In addition to groups, Admins can grant or restrict specific permissions on a per-user basis. This is useful for one-off exceptions -- for example, giving a Manager temporary access to webhooks for an integration project, or restricting a specific Admin from managing API keys.
Per-user overrides take precedence over group permissions and the base role.
API key scopes
API keys have their own scope system that operates independently of user roles. When creating an API key, you select which operations the key can perform:
| Scope | Access |
|---|---|
assets:read | List and retrieve assets |
assets:write | Create, update, and delete assets |
devices:read | List and retrieve devices |
devices:write | Manage device assignments and settings |
geofences:read | List and retrieve geofences |
geofences:write | Create, update, and delete geofences |
locations:read | Query location history and trip data |
locations:write | Submit location data via the ingest API |
alerts:read | List alerts and alert history |
webhooks:manage | Create, update, and delete webhooks |
Warning
Follow the principle of least privilege when creating API keys. Only grant the scopes that the integration actually needs. You can always add scopes later if requirements change.
Next steps
- Set up your team with Team Members
- Learn about Organizations and workspace management
- Explore Billing to understand plan differences