Access in Tamaat comes from three places: the role a person holds in your organization, what has been shared with them, and the Server permissions they have been given. Each is set separately, and the highest one that applies is what they get.
Roles
Every member of an organization holds one role. An Admin assigns roles under Organization → Members & sharing; invitations offer Admin, Analyst and Viewer. Each role includes everything the one before it can do.
| Viewer | Analyst | Publisher | Admin | |
|---|---|---|---|---|
| Needs a seat | No | Yes | Yes | Yes |
| Open what is shared with them | Yes | Yes | Yes | Yes |
| Open published maps and dashboards they are allowed to see | Yes | Yes | Yes | Yes |
| Build maps, layers, files, flows and APIs | — | Yes | Yes | Yes |
| Share their own work with people in the organization | — | Yes | Yes | Yes |
| Publish to Server and operate what is served | — | — | Yes | Yes |
| Approve promotions and manage consumer keys | — | — | Yes | Yes |
| Invite members, assign roles and seats | — | — | — | Yes |
| Set the sharing policy and organization settings | — | — | — | Yes |
| Manage Server environments, policy and access groups | — | — | — | Yes |
| Billing and the subscription | — | — | — | Yes |
Viewers are free. They use no seat, and there is no limit on how many you invite. An organization can have several Admins, and the last one cannot be removed, so the organization is never left without one.
What no role can do
A role never opens work on its own. Nobody, including an Admin, can open a map, layer or dataset that its owner has not shared with them. An Admin manages membership, seats and settings; they see what other members have created only when it is shared with them, like anyone else.
Sharing
A layer, a project or a layer group is shared with named people at one of two levels:
| View | Edit | |
|---|---|---|
| Open it and look | Yes | Yes |
| Change it, in the same place, at the same time | — | Yes |
| Share it on, or remove it | — | — |
Sharing to View is on every plan. Edit is working together, which is part of Professional and above. Only the owner shares something on or takes it back. See Collaboration and Sharing.
Inviting someone to view a map needs nothing from them but an email address. They can view that map and nothing else, and they use none of your seats.
How far sharing reaches is your organization's choice. The Sharing Policy is set for projects, layers and layer groups separately: Organization users only, or Any platform user. When the policy blocks a share, the Share dialog says why. See Organization Management.
Anything public goes through Server. A map, dashboard or API reaches people who are not signed in only once it is published to Tamaat Server. Someone who opens a published address they are not allowed to see can Request access, and the organization's Admins decide.
Server permissions
Publishing, promoting and operating what your organization serves is a separate set of permissions. A Publisher and an Admin hold them by default; an Analyst does not.
An Admin can also give Server permissions to anyone with a seat through Server access groups, for all environments or for one. A group starts from a template and can be changed afterwards:
| Template | What it allows |
|---|---|
| Viewer | See what is served and its activity |
| Publisher | Publish releases and request promotion |
| Operator | Run what is served: pause, roll back, disable a schedule; request promotion |
| Approver | Approve releases when Production is protected |
| Credential Manager | Issue and revoke consumer keys |
| Administrator | Manage environments, groups, grants and policy |
A group assignment gives Server permissions only. It does not assign a seat, and it does not share anyone's source data.
Protecting Production. Your organization can require a particular role to promote, or a second Admin's approval. See Tamaat Server.