RMS permissions are scoped along three nested entities: Owner, Organisation, and User. Understanding how these relate to each other is essential for administering the platform, because almost every action is gated by where the actor sits in this hierarchy and what role they hold.

The hierarchy

An Owner is the top-level tenant in the RMS. Each Owner has its own users, organisations, assets, alert definitions, and (optionally) theming. Cranepower customers and rental companies are typically modelled as separate Owners. Owners are created by Cranepower (SuperAdmin only).
An Organisation ("Org") sits under an Owner. Orgs are how an Owner subdivides its assets and access — for example, by site, customer, region, or fleet. An Org belongs to exactly one Owner.
A User is a person with login credentials. A user belongs to exactly one Owner and can be a member of zero or more Organisations within that Owner. A user's effective asset access is the union of the assets in the Organisations they belong to.

<aside> 🖼️

Screenshot placeholder — Diagram of Owner → Organisations → Assets / Users. (To be drawn or supplied; no live screen captures this view.)

</aside>

Roles

Four roles exist, in decreasing order of privilege:

SuperAdmin — a Cranepower-only role that can act across every Owner. Used for support and platform operations. Not granted to customers.
Owner Admin — full administrative control of a single Owner: users, organisations, asset ↔ organisation assignments, themes (if enabled), and alert configuration.
Org Admin — administrative control of a single Organisation: managing its name, its memberships up to Org Admin, asset names, and alert generation/subscriptions for the Org's assets and users.
User (also called Org User) — read access to assets and data within the Organisations they belong to, plus self-service controls (own alert subscriptions, own password).

A user's role is set per scope:

An Owner Role of either User or Owner Admin (the latter granting Owner-wide admin rights).
An Organisation Role of either User or Admin, set per Organisation membership.

The SuperAdmin flag is independent and overrides every scope.

Capability matrix

The table below summarises which role can take which actions. Source: User Docs.

Feature / Action	SuperAdmin (CP only)	Owner Admin	Org Admin	Org User
Create new Owner	✅	❌	❌	❌
Edit Owner name	✅ any Owner	✅ own Owner	❌	❌
Edit Owner theme	✅ any Owner	✅ if theme-edit flag set	❌	❌
Create new Org	✅ any Owner	✅ own Owner	❌	❌
Edit Org name	✅ any Org	✅	✅	❌
Add existing user to Org	✅ any User	✅ Users in own Owner	❌	❌
Create new User	✅ in any Owner	✅ in own Owner	❌	❌
Reset own password	✅	✅	✅	✅
Change permissions	✅ any User	✅ in own Owner, up to Owner Admin	✅ in own Org, up to Org Admin	❌
Assign user to Org	✅ any User/Org	✅ in own Owner	❌	❌
Create / configure Assets	✅	❌	❌	❌
Rename Asset in an Org	✅	✅	✅	❌
Move Asset between Orgs	✅	✅ within own Owner	❌	❌
Create new Alert Definitions	✅	❌	❌	❌
Configure Asset Alert Generation	✅ all Assets	✅ Assets in Owner	✅ Assets in Org	❌
Configure User Alert Subscription	✅ all Users	✅ Users in Owner	✅ Users in Org	✅ self only
Manage Data Pipeline	✅	❌	❌	❌
View Asset Data	✅ all Assets	✅ Assets in own Owner	✅ Assets in Org	✅ Assets in Org
Explore Status / Timeseries Data	✅	✅	✅	✅

How this shows up in the UI