Organize access around responsibilities, then verify what each person can actually see and do.
Reflect the people behind the project.
Organization membership establishes who belongs to your working organization. Project teams bring together people with a shared responsibility, such as field reviewers, integration operators, or the engineering group responsible for a particular area.
Assign access to the team so a consistent set of grants follows that responsibility. Direct user grants are also available for supported scopes. This lets administrators handle a specific need while retaining a structure that is easier to inspect as the project and its participants change.
Choose both the scope and the capability.
Instrument visibility can be scoped to a project, a site, or an instrument group. Additional project capabilities cover work such as pipeline management, connector diagnostics, parser management, anomaly management, and instrument data writing. Use the combination that matches what the person is expected to accomplish.
For example, a reviewer responsible for one site may need access to its measurements, while an integration operator needs the diagnostics used to investigate incoming data. Those are different responsibilities. Neither automatically requires broad organization administration rights.
- Project, site, and instrument-group scopes for measurements.
- Operational capabilities for ingestion and anomaly workflows.
- Dashboard viewer grants for a focused review audience.
Check the experience behind the permission.
A member's effective access combines direct grants and inherited team grants. Use the member Access view and the project access inspector to see the result, including effective instruments. A person may retain access through another team even after one grant is removed.
Dashboard viewing and browsing the instrument catalog are separate capabilities. Verify the intended stakeholder experience instead of assuming that one grant implies the other. When something is missing, check the selected organization, project, capability, and scope before increasing privileges.
Manage changes across the whole workflow.
Site assignments and group membership can affect visibility, so an instrument move deserves an access review. Team changes, project handovers, and organization departures also need attention. SanSignal exposes grants and inherited access to help administrators understand these effects.
Notification resources and integrations have their own boundaries. A contact group defines email recipients, not application access. Organization-owned external connections can be granted to projects without exposing upstream credentials to pipeline operators. Developer integrations use separately scoped API keys for their supported operations.
Common questions.
Can we give a team access to one part of a project?
Yes. Instrument grants can use site or instrument-group scope, and dashboard viewer grants support a focused dashboard audience. Inspect effective access after configuring the team.
Can project operators manage pipelines without seeing source credentials?
Organization administrators own external connections and grant projects permitted access. Project pipeline access does not expose upstream credentials or grant control over organization connection grants.