How to add a new user
This guide walks through adding a new user to the Energyworx platform, from start to finish. It explains what each step is, why it is needed, and who is responsible.
For detailed information on permission groups and their configuration, see How to Whitelist and Assign Permissions. For granting access to everyone at an email domain automatically, see access rules below.
Overview
Access to a namespace is one record: a grant, which names the user's email address and the permission groups they hold in that namespace. Granting access and assigning permissions are therefore the same step, and it can be done before the user has ever signed in.
| Step | Action | Who | Result |
|---|---|---|---|
| 1 | Grant the user access to a namespace, with groups | Customer admin | The user can sign in and work in that namespace |
| 2 | User signs in | The user | Their platform account is created |
Key concepts
- Billing Account: The top-level organizational unit for your organization. Contains one or more namespaces.
- Namespace: A workspace within a billing account that holds datasources, configurations, and other resources. Access is granted per namespace.
- Grant: A user's access to one namespace, holding the permission groups they have there. A user can reach a namespace exactly when a grant with at least one group exists for them, so removing access means revoking the grant. The same person can hold different groups in different namespaces.
- Permission Group: A set of permissions that controls what a user can do within a namespace (e.g., view datasources, start flows, manage configurations). Each customer defines their own groups.
- Grant rule: A rule that grants everyone matching an email domain a set of groups on a namespace, applied on each user's next sign-in.
Responsibility split
| Action | Responsible |
|---|---|
| Creating a new namespace | Energyworx (via Service Desk) |
| Granting users access to namespaces | Customer administrator |
| Assigning permission groups to users | Customer administrator |
Before you can grant access and assign permissions, your organization must have designated administrators with the appropriate base permissions. If this has not been set up yet, see Initial Setup: Designating Your Administrators.
Step 1: Grant the user access
Required permissions: read and create on the iam resource, in the namespace you are granting access to.
Steps:
- Navigate to IAM → Users
- Click Invite user
- Enter the user's email address
- Select the namespaces the user needs access to
- Select the permission groups the user should have there
- Save
Nothing is emailed: the invitation is the access, and the user has it as soon as they sign in.
The page administers every namespace you can reach, so you need not switch namespace first, and one invitation can cover several at once: checking a namespace expands it to show that namespace's own groups, so the user can hold different groups in each. The Default group comes with the namespace and cannot be unchecked — granting someone a namespace is saying they may work there, and Default is what that means.
To change what someone may do later, open their row and use Edit groups on the namespace concerned; to take their access away, use Revoke. The same popup grants them a further namespace, with different groups if you want.
Access and permissions are the same record, and it can exist before the user's first sign-in. If you are looking for the old Whitelist screen, this is what replaced it.
Step 2: User signs in
The user signs in with their Google, Microsoft, or linked identity provider account. On first sign-in the platform creates their account, and the namespaces they hold a grant on appear in the namespace selector (top right).
Because their groups were assigned in step 1, they can work in the namespace straight away.
Granting access automatically with a grant rule
For a whole organization, a rule is less work than a grant per person. A rule matches the domain of the user's email address and grants a set of groups on one namespace; every matching user gets that access on their next sign-in, including colleagues who have never signed in before.
Steps:
- Navigate to IAM → Users
- Click Access rules
- Click New rule
- Select the namespaces the rule should grant access on
- Keep Match on set to Email domain and enter the domain (for example
example.com, without the@) - Select the permission groups matching users should get
- Save
A rule keeps the access it grants up to date: changing its groups changes what matching users hold, and deleting the rule revokes the access it granted — both applied on each user's next sign-in. Grants an administrator made by hand are never touched by a rule.
Summary
After both steps, the user:
- Can authenticate with the platform
- Has a platform account (created on first sign-in)
- Can access namespace resources according to the groups on their grant
If something is missing:
| Situation | Effect |
|---|---|
| No grant on any namespace | User can authenticate but reaches nothing, and sees no namespaces |
| Grant with the wrong groups | User can open the namespace but cannot use the parts their groups do not cover |
| Grant revoked | User loses access to that namespace immediately, on their next request |