How to manage sub-users and quotas
Delegated access has two halves: what someone can see and do, and how much of your license they are allowed to consume. This guide covers both, and the request flow that handles it when someone runs out. See also permission groups and license and instance management.
- 1
Build the permission group before the user
A permission group combines page-level access, which pages a user can open, with create, read, update and delete rights per resource. Define it once and reuse it, rather than reasoning about one person at a time. Disabling a page also removes its CRUD permissions, so there is no state where someone holds edit rights over something they cannot reach.
- 2
Add the sub-user and assign exactly one group
Set their details and either choose a password or generate one. Each user carries exactly one permission group, which is deliberate: overlapping roles are where access control quietly becomes unauditable, because nobody can say what a given person can actually do without resolving several groups in their head.
- 3
Assign sites and cameras explicitly
Pick the sites and cameras that user can reach, with snapshot previews to confirm you have the right ones. Grant the narrowest set that lets them do their job, a contractor covering one site should not be able to open another, and site-scoped access is what makes a multi-tenant or landlord arrangement workable at all.
- 4
Allocate quota out of what you actually hold
Grant AI feature instances, streams, patrolling instances and backup storage from your own unused allocation. You cannot give away more than you hold after your own usage and other grants, so the arithmetic is enforced rather than left to you to track.
- 5
Handle quota requests instead of over-provisioning
When a sub-user reaches a limit they are offered a request form, and it arrives in your Quota Requests tab to approve or decline. This is the reason not to over-allocate up front: the request flow surfaces genuine demand with a name attached, rather than quota sitting unused because someone asked for headroom once.
Grant the narrowest access that lets someone do the job, then widen it when they ask. It is the one access-control habit that survives staff turnover: permissions granted generously at setup are almost never reviewed afterwards, and an account that has been running for two years usually cannot say why half its grants exist.
Related: user management, for managed service providers, and what we log.
Frequently asked questions
Ready to patrol your site 24/7?
Book a 15-minute demo and see a live patrol run on your own cameras.