How access control works on MontBlancAI
MontBlancAI gives you fine-grained control over who can see and do what. This article explains the model end to end; the related articles cover each piece in depth.
The building blocks
Users — people in your organization. Users join by invitation and can belong to multiple organizations.
Owners & admins — organization-level administrators. They manage the organization itself and automatically have full access to everything in it.
Permissions — the individual capabilities MontBlancAI defines, such as View equipment, Edit thresholds or Use Alpinist chat. The permission catalog is fixed by the platform — you choose who gets which permissions, not what permissions exist.
Roles — named bundles of permissions that you define for your organization (for example "Machine Admins" or "Read Only").
Teams — groups of users. Roles and permissions are granted through teams: either to everyone in a team, or to a specific user within a team.
Resource Groups — groups of assets (sites, areas, lines, equipment) that scope where a team's permissions apply.
How a user gets access
Access always flows through teams:
```
User → is a member of → Team → has → Roles → contain → Permissions
(optionally scoped by Resource Groups)
```
Every member starts with baseline access. Each organization has a Default team that automatically contains all members, and a Default Role granting the standard product permissions (viewing and working with assets, dashboards, incidents, and so on). Administrative permissions — managing users, roles, teams, and resource group access — are not part of the Default Role and must be granted deliberately.
Teams add more. A team can carry *default roles* (applied to every member of the team, current and future) and extra individual permissions. You can also assign a role to one specific user within a team.
A user's access is the union of all their teams. If any of your teams grants a permission, you have it.
Resource groups scope it to assets. For asset-related permissions, holding the permission is not always enough — the team that grants it must also have access to the resource group containing the asset you're working on. Until you create custom resource groups, all assets are in a single organization-wide group and permissions apply everywhere.
An example
Suppose Maria is in two teams:
Quality Team, which has the role Read Only (view permissions on all assets) and access to all resource groups.
Packaging Engineers, which has the role Machine Admins (full asset permissions) but access only to the "Packaging" resource group.
Maria can view everything in the organization, but she can only edit equipment that belongs to the Packaging resource group. On an equipment page outside Packaging, she has read-only access.
Owners and admins bypass permission checks
Organization owners and admins automatically have full access to all product features and assets — roles, permissions, and resource groups do not restrict them. Use these positions sparingly and grant everyone else access through teams and roles.
Checking what someone can see
Owners and admins can use View As to preview MontBlancAI exactly as another user (or a set of teams) would see it — a safe way to verify a role setup before rolling it out.