Invite your team

Add the people who work with your fleet, and give each of them only what they need: someone who watches, someone who flies, someone who signs off risky steps.

Choose the right roles

A user has one or more roles. Roles add up: someone who flies and signs off steps gets Operator and Approver.

Role	What they can do
Viewer	See the map, devices, telemetry, runs and recorded media.
Operator	Everything a viewer can, plus start runs, take remote control, and start or stop live video.
Approver	Decide approval steps that are addressed to approvers.
Org Admin	Everything an operator can, plus manage users, devices, credentials, event triggers, dispatch rules and the organization's settings.

Invite a user

1. Open Access Control

   Open Manage›Access & Integrations›Access Control. It lists everyone in your organization with their roles. Select Invite user ①.

   1

2. Enter the email and roles

   Type the person's email address and tick their roles. Viewer is ticked by default; untick it when you choose another role.

   

   Select Create user.

3. Send the temporary password

   The console shows a temporary password once. Copy it and send it to the person on a channel you trust. They sign in with their email address and this password.

   If you lose it before sending it, select Reset password on their row: you get a new one.

Manage a user

Each row in Access Control has these actions:

Action	What happens
Edit roles	Replaces the user's roles. They are signed out everywhere and get the new roles at their next sign-in.
Disable user	Signs them out and blocks sign-in until you enable them again. Their seat stays reserved.
Reset password	Creates a new temporary password, shown once, and signs them out everywhere.
Revoke all sessions	Signs them out everywhere. They can sign in again right away.
Delete user	Removes the user for good and frees their seat. The email address can be invited again. This cannot be undone.

You cannot edit the roles of, disable or delete your own account. Ask another organization administrator.

Let only approvers decide a step

A Human approval step in a Skill can be addressed to approvers. Select the step in the Skill editor and set Approval group to approver. From then on, only users with the Approver role can approve or reject it. Without an approval group, any signed-in user of your organization can decide it.

Sign in with your company account (SSO)

Your users can sign in with your own identity provider, for example Microsoft Entra ID, Okta or Google Workspace, instead of a Zequent password. Any provider that supports OpenID Connect works. Single sign-on is switched on for your organization by your Zequent platform administrator.

1. Register Zequent in your identity provider

   Create an OpenID Connect web application in your identity provider with:

   • Redirect URI: your console address followed by /auth/callback, for example https://console.your-company.com/auth/callback.
   • Scopes: openid, email and profile.
   • A claim on the ID token that lists the user's groups, usually groups.

2. Send the details to your platform administrator

   Detail	Example
   Issuer URL	https://your-company.okta.com
   Client ID and client secret	From the application you just created.
   Email domains	your-company.com. Everyone who signs in with an address in these domains is sent to your identity provider.
   Role claim name	groups
   Group to role mapping	Zequent-Operators → Operator, Zequent-Admins → Org Admin

3. Sign in

   On the sign-in page, users enter their email address and are taken to your identity provider. Their Zequent account is created at their first sign-in and takes a license seat.

With single sign-on, roles come from your directory:

• A user gets the roles their groups map to, refreshed at every sign-in. To change someone's roles, change their groups in your directory.
• A user in none of the mapped groups gets Viewer.
• Edit roles is not available for these users in the console.

Troubleshooting

• Create user fails with a seat error. Every seat on your license is in use. Raise the seats on your license in the Zequent Hub, or delete a user you no longer need. A disabled user still holds a seat.
• An action is refused for a user. Their roles don't allow it, for example a viewer starting a run. Edit their roles; they get the new ones at their next sign-in.
• An approver can't decide a step. Check the step's Approval group: it must be exactly approver, and the user must have the Approver role.

Next steps