This article provides an overview of the different user permissions, how they can be applied, and the features and configurations they allow access to.
When thinking about permissions, the most important concept to keep in mind is the difference between the organization, site, alarm, access control, and Guest permissions:
Organization permissions have to do with user management (being able to access the organization, inviting users to the organization, etc.)
Site permissions define access to cameras
Alarms permissions determine who can arm/disarm sites
Access control permissions determine who can view and manage access control devices
Guest permissions determine who can manage the Verkada Guest visitor management feature in Command
Since organization, access control, and site permissions serve different purposes, they are separate. However, users will need to have permissions set for these levels to have full use of Command.
Organization and Site Permissions
Permissions are set at the following levels:
Organization
All users added to the organization have the ability to log in to the Command organization. Only those users designated as an Organization Admin may invite/delete other users, create sites, and modify all permissions.
Site
Site-level permissions define what access a particular user or group has to the cameras within the site. Site-level permissions are configured using Roles (No Access, Live-Only Viewer, Site Viewer, and Site Admin), which are described in more detail in the Roles section below.
Sub-Site
Sub-site permissions are no different from site-level permissions. The only difference is that sub-sites inherit the permissions of the sub-sites and parent sites above them.
Roles
There are four levels of access that a user or group may have to a site or sub-site:
Site Admin: Permits users to view cameras, add cameras, archive and share video, change camera settings, create and delete archived videos, take snapshots, and edit site permissions.
Site Viewer: Permits users to view cameras, create archived videos, and take snapshots.
Live-Only Viewer: Permits users to only view camera live streams (no access to historical video, archives, or live link sharing).
No Access: Users will have no access to the site or sub-site's camera live feeds, historical video, or archives.
Permissions Considerations
Sites and sub-sites do not inherit permissions from the organization (being an Organization Admin does not automatically make you a Site Admin).
Sub-sites inherit permissions from all sub-sites (and the ultimate parent site) above them.
A user can be assigned to multiple groups. If permissions conflict, the user is always granted the highest role granted to them directly, or to one of the groups to which they belong. For example, if a user is assigned to a group which assigns the role Site Viewer for a particular site, but is also assigned to a group which assigns the role Site Admin for that same site, the user will be granted Site Admin permissions for that site.
Permissions can always be upgraded, but never downgraded. For example, if a user is assigned to a group that assigns the role Site Viewer for a particular site, that user may be manually upgraded to Site Admin for that site. However, this user cannot be downgraded to a Live-Only Viewer (or any role below Site Viewer). A user's role can only be downgraded if they are removed from the group which assigns the highest level of access.
Common User Permissions Configurations
Permit a user to be able to view, archive, and take snapshots of footage:
User must be added to the organization
Site Viewer on appropriate sites or sub-sites
Permit a user to view, archive, share, and take snapshots of footage and modify camera settings, and set other users' permissions globally:
User must be added to the organization and made an Organization Admin
Site Admin on all appropriate sites or sub-sites
Permit a user to view, archive, share, and take snapshots of footage and modify camera settings, and set other users' permissions on certain cameras:
User must be added to the organization
Site Admin on all appropriate sites or sub-sites
Permit a user to only view live streams of cameras:
User must be added to the organization
Live-Only Viewer on all appropriate sites or sub-sites
Setting Permissions for Users
Please see our step-by-step guide on setting permissions. This article provides an overview of the different user permissions, how they can be applied, and the features and configurations they allow access to.
Access Control Permissions
Only Access Admins and Access Managers are able to view the access control infrastructure. For full functionality of the access control devices, the Access Admins and Access Managers should also be Organization Admins.
Access Admin: Permits full management of doors, controllers, access levels, access groups, and access users. Can view live and historical access events and run reports for historical events
Access Manager: Permits addition and modification of access users, view doors, view live and historical access events, and run reports for historical events
Please see the article Detailed Role Breakdown for an in-depth explanation of the features and configurations available to users or groups with different roles.
Alarm User Permissions
The ability to arm/disarm alarm sites can be explicitly granted to users beneath the level of Site Admin. For example, Site Admins by default will have explicit permissions to arm/disarm their alarm site. Site Viewers, Live-Only Viewers, and even No Access users by default do not have the ability to arm/disarm, but, can be granted permissions by existing Alarms Site Admins. The arm/disarm capability is denoted by the Alarm User Checkbox in the user settings profile.
Site Admins: By default can arm/disarm sites via Command and the Alarms mobile app. They also have the capability to set up new alarm sites and change all alarm site settings, including trigger events and alarm response notifications/actions. They can also add/delete new devices and wired inputs/outputs in the alarm site. Site Admins are able to view all alarm activity and event history with historical video. They also have full capability of the console and are able to listen in and initiate talk-downs to the alarm console.
Site Viewers: By default do not have the ability to arm/disarm alarm sites, these users will have to be explicitly granted alarm user permissions. Site Viewers can view all alarm activity and event history with historical video. Site Viewers are able to view Alarm Site settings page and listen in/initiate talk-downs to the alarm console.
Live-Only Viewers: By default do not have the ability to arm/disarm alarm sites, these users will have to be explicitly granted alarm user permissions. Live-Only viewers can see live video, alarm activity, and event history on the alarm site page.
No Access Users: By default do not have the ability to arm/disarm or view any details regarding alarm sites in Command. If explicitly granted alarm user permissions they will have the ability to arm/disarm an alarm site from Alarms Mobile app
Verkada Guest Permissions
Please see the article Guest Users and Permissions for an in-depth explanation of the different types of Verkada Guest permissions roles available to Command users.
Intercom User Permissions
Please see the article Intercom Permissions Breakdown for an in-depth explanation of the different types of Intercom roles available to Command users.
Visit Training Center for bite-sized video tutorials on how to accomplish role-based tasks in Command.