Users roles permissions

REDIRECT: This URL has changed to
Click the link above if you are not automatically redirected in 10 seconds.

Role Based Access Control

GroundWork Monitor incorporates Role Based Access Control (RBAC) to enable Administrators to restrict specific system access to authorized users. This includes access control at the role level to menu navigation, inventory visibility and configuration of inventory entities including hosts, services, host groups, service groups, and custom groups. 

role based access control


User access to GroundWork Monitor menu options and inventory is based on associated roles.

ROLES are assigned to USERS. This determines user access.

  • The default system users include admin, operator, and user.
  • The default system roles include Admin, Operator, UserBSM-Admin, and BSM-User.
  • The default user/role assignments are admin/Admin and admin/BSM-Admin, operator/Operator, user/User and user/BSM-User.
  • These system defaults cannot be deleted.


ROLES are assigned access to inventory through GROUPS, including host groups, service groups, and custom groups. This controls which users can see which monitored resources in inventory, i.e., which groups of hosts and/or services. 

  • Assigning any of the group types to a role sets an access control allowing users with that role to access resources in the group.
  • If a role is left without specific access to any group of any type, the role gets full access to all inventory.
  • If a role has access to more than one group, or a user is a member of more than one role, the user can access the union of all resources in all groups assigned to their roles. 
  • An example:
    • An East Region role is restricted to host groups host-group-a and host-group-b, the service group service-group-a, and the custom group custom-group-a.
    • Roles are assigned to users, therefore any users assigned the East Region role will be restricted to host-group-a, host-group-b, service-group-a, custom-group-a inventory.
    • Roles are assigned to menu items, therefore any menu items assigned the East Region role will be accessible to users with that role. In addition, inventory accessed through applications on those menu items will generally be restricted to host-group-a, host-group-b, service-group-a, custom-group-a inventory.


      Inventory role restrictions

      Inventory role restrictions have not been ported to all the applications in GroundWork Monitor. Some menu items (e.g., Dashboards > Log Analysis) allow access to the full range of application functionality to users who have access to the menu item. Care should be taken when allowing access to menu items to ensure no users who do not have clearance, training or experience can use them. 

Menu Items

ROLES are assigned access to applications through MENU ITEMS. This controls which users can access which menu items.

  • The Menu Editor application allows administrators to customize the GroundWork menu, by modifying top-level and sub-menu items and permitting secure access by role.  
  • An example: The user user has access to the Configuration > Nagios Monitoring > Hosts menu item, however no other Nagios Monitoring menu items.
    • Why? Because, by default, the menu item Configuration permits All Roles*, the menu item Nagios Monitoring permits All Roles*, and the menu item Hosts permits All Roles*. However, all other Nagios Monitoring sub-menu options are assigned to only the role Admin. Therefore, the user user which is assigned the role User will have restricted access to only the Hosts menu item.
    • Similarly, the user admin has access to all Dashboards, where, again by default, the user user has access to a sub-set of Dashboards.

      menu items

Default roles assigned to menu items

The table below outlines the GroundWork menu structure listing the top-level options, sub-level components, and the default roles assigned. For example, the menu folder Administration, has several underlying Menu Items, each with their assigned role. Users assigned the Admin role can access all Administration menu items, all other roles can only access My Account.

** includes underlying items

Users >adminoperatoruser

Roles >AdminOperatorUserBSM- AdminBSM-User
Administration >

My Account







Audit Log

Menu Editor

Configuration >

Nagios Monitoring >







Time Periods



Maintenance **

Downtime >



Host Group

Service Group

BSM and SLAs >



SLA Dashboards

Auto Discovery >



Cloud Hub

Network Discovery


Devices **

Custom Groups

Dashboards >



His List

NOC Board


SLA Carousel


Log Analysis


Nagios **

Reports >

SLA Reports

Custom Reports

Related articles