Roles and permissions
Roles on the node, the six permissions, group-limited access and superadmins.
Access inside Retivo is decided by two things: the user's role (what they may do) and their groups (which devices they may see).
What everyone can do
Every user can view devices, configs, changes, topology and vulnerabilities inside their groups, and export vulnerability lists.
Permissions
A role adds any of these:
| Permission | What it allows |
|---|---|
| Audit all users | See and export every user's actions in the audit log. Without it, a user sees only their own. |
| SSH terminal | Open the terminal in the browser |
| Checks and backups | Check status, back up and check vulnerabilities on demand |
| Edit devices | Add, edit, delete and import devices, add them to groups, discover subnets |
| Push config | Push changes, restore versions, upload firmware, delete old images and run upgrades |
| Manage settings | Manage groups, credentials (including backup destinations) and settings |
Four roles exist after the first start: Audit / read-only, Troubleshooter, Installer and Admin. You can rename, change or delete them and add your own. When you choose a role for a user, Retivo shows exactly what it allows and what it does not.
Superadmins
Users marked Superadmin manage users and roles and see everything. The first admin user is one, and at least one active superadmin must always remain.
Company roles on dash.retivo.net
Your account on dash.retivo.net has its own, simpler roles:
| Role | Can |
|---|---|
| Owner | Everything, including other owners |
| Admin | License, nodes, users, directory sign-in, audit log |
| Member | Use Retivo |
What's next
Last modified October 15, 2026