Subtenant Roles

Subtenant Roles defines permission sets for subtenant admin accounts. It uses the same RBAC model as the main tenant Roles & Permissions module, but the available permissions are scoped to the operational tasks a subtenant admin can perform.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/subtenant-roles/overview.png

Built-In Subtenant Roles

Role	Access Level	Description
Subtenant Admin	Full subtenant access	Complete access to all permitted subtenant operations — manage users, view logs, run reports, manage vouchers. Cannot access global settings or other subtenants.
Subtenant Manager	Operational	Can manage users and vouchers and view reports, but cannot change subtenant configuration or delete records.
Subtenant Viewer	Read-only	Can view users, logs, sessions, and reports for the subtenant. No create, edit, or delete access.

Available Permissions for Subtenant Roles

Subtenant roles can only be assigned permissions from the subtenant-scoped permission set. This is a subset of the full tenant permission list:

• Users — view, create, update, delete WiFi users within the subtenant
• Vouchers — view, create, delete vouchers within the subtenant
• Profiles — view access profiles (read-only; profiles are managed by main tenant admin)
• Reports — view bandwidth, login, and user reports filtered to the subtenant
• Portal Log — view portal log events for the subtenant's zones
• Portal Sessions — view active sessions for the subtenant's zones
• Subtenant Profile — view and update the subtenant's own name and description

Permissions that are not available to subtenant roles include: system settings, connectors, portal designers, zone management, device configuration, other subtenants, and any superuser-only operations.

Custom Subtenant Roles

Create custom roles with any combination of the permitted subtenant permissions. For example, a Voucher Manager role could have only view-users and full voucher permissions — suitable for front-desk staff who issue vouchers but should not edit user accounts.

Actions

• Create — enter a role name and select permissions from the permission grid.
• Edit — update the role name or permission set. Changes take effect immediately for all admins assigned to the role.
• Delete — blocked if any subtenant admin is currently assigned to the role. Reassign those admins first.

Required Permissions

view-subtenant-roles · create-subtenant-roles · update-subtenant-roles · delete-subtenant-roles