Tab Access Control (RBAC)
OpenMES uses Role-Based Access Control (RBAC) to decide which parts of the application each user role can see and use. The Tab Access screen shows a permissions matrix where you grant or revoke access per role.
How It Works
The Tab Access screen displays a permissions matrix where:
- Rows represent application tabs – Dashboard, Work Orders, Products, Warehouses, Reports, HR, Maintenance, Connectivity, Packaging, Settings, and more.
- Columns represent user roles – Admin, Supervisor, Operator, and any custom roles you define.
- Checkboxes at each intersection control whether that role can access that tab.
The Admin role always has full access to every tab. This cannot be changed – it ensures at least one role can always manage the system. For all other roles, administrators check or uncheck individual tabs to build the exact permission set each role needs.
Default Permissions
Out of the box, OpenMES ships with sensible defaults:
- Admins – access to all tabs.
- Supervisors – access to most tabs except Settings and HR.
- Operators – access to the Operator View only.
You can change these defaults at any time. Changes take effect on the user's next page load – no logout or session restart is required.
Server-Side Enforcement
Tab Access Control is not just UI hiding. When a user tries to access a restricted tab – even by typing the URL directly into the browser – the server rejects the request with a 403 Forbidden response. RBAC permissions are enforced at the API level, not just in the navigation menu. This means:
- Restricted tabs are hidden from the sidebar.
- Direct URL access is blocked.
- API requests for restricted data are rejected.
- There is no way to bypass access control from the client side.
Give each role access only to the tabs it truly needs. Operators do not need Settings, API Tokens, or HR data. Supervisors do not need system configuration. Limiting access lowers the risk of accidental changes and reduces damage if an account gets compromised.
A pharmaceutical manufacturer creates a "Quality Manager" role with access to Products & Traceability, Reports & Analytics, Maintenance & QC, and the Dashboard – but not Work Orders, HR, or Settings. The quality team can review traceability records, run reports, and manage QC checklists. They cannot change production orders or system settings. This meets the auditor's requirement for separation of duties.