Access control

FleetAMP enforces permissions in the API as well as the UI.

Administrators assign each scoped user to one or more groups. The Managed Users table shows role, group access, status, last login, and password state. Each user can open My account to review effective access, select an IANA timezone, and reset their own password.

Capability	Admin	Group Owner	Operator	Viewer
View all groups and collectors	Yes	Owned groups	Assigned scope	Assigned scope
Create groups and assign owners	Yes	No	No	No
Edit group configuration	Yes	Owned groups and allowed sections	No	No
Submit approval request	Yes	Owned groups	No	No
Approve or reject request	When assigned; not own request	When assigned to an owned group	No	No
Cancel pending request	Any request	Own request in owned group	No	No
Deploy or roll back	Yes	Through approved workflow	Operational assistance only	No
Manage users and policies	Yes	No	No	No
Delete unassigned collector	Yes	No	No	No
Delete owned-group collector	Yes	When permitted	No	No
View approval history	Yes	Owned or assigned scope	No	No
View control-plane audit log	Yes	No	No	No

Group ownership never grants access to another group, even when labels, versions, or collector metadata look similar. Reviewer assignment is request-specific and does not grant broader group permissions. Approval separation prevents a requester from approving their own change.