Defining Permissions
You need to set up Permissions to define which types of resources your Targets will be allowed or denied access to.
The resources available to grant permission depend on the Target you select, and the rules available depend on the resource selected. For more information, see Defining Targets.
Adding resources and how rules are applied
You can add as many resources as needed. An OR operation is applied between permissions: as you add more permissions, more resources will be included in the verification process.
Denial permissions will override any permissions granting access to the same resource.
AI
The AI resource controls the AI Chat in TagoRUN for Run user Targets. It has no individual resources to match, so its permission always applies to the whole feature. Its rules are:
| Rule | What it grants |
|---|---|
| Access | The user sees and can use the AI chat. Required for every other rule. |
| Read device data | The assistant can list devices and read their data on the user's behalf. |
| Read entity data | The assistant can read entity schemas and data on the user's behalf. |
| Read dashboards | The assistant can list dashboards on the user's behalf. It does not let the user change an AI Dashboard; that is AI dashboard generation on the Dashboard permission. |
| Read users | The assistant can list TagoRUN users on the user's behalf. |
The read rules say what kind of resource the assistant may read. Which resources it may read is decided by the AI access rule on the resource permission itself.
AI access on resources
Device, Entity, Dashboard, Run User, and SQL Query permissions for Run user Targets have an AI access rule next to their existing rules. It marks the matched resources as readable by the assistant for the targeted users, and matches by ID, tag, or Any like any other rule.
AI access is separate from the rules the portal uses. Dashboard access on a device lets the user see it in dashboards and says nothing about the assistant. Grant both when the user should have both.
A complete grant to read device data therefore needs two permissions: AI with Access and Read device data, and Device with AI access on the devices in question. A grant missing either half reads nothing.
AI and Custom Dashboards
Run users can view AI Dashboards and Custom Dashboards in TagoRUN. Both need Dashboard with Access. Their data needs a different second permission:
| Dashboard type | Data permission | What limits the data |
|---|---|---|
| AI Dashboard | Device with Dashboard access, and Entity with Blueprint access for entity data | Queries return rows only from the devices and entities the user can access. Live update signals follow the stream rule in the live streams row below. See When access changes for what happens when a rule is removed. |
| Custom Dashboard using SQL | SQL Query with Access and Execute | The query itself, through Session Context. |
| Custom Dashboard using Endpoints | Analysis with Call Endpoint | The Analysis's code, using the caller's identity to limit returned data and changes. |
| Custom Dashboard using live streams | A Run user's stream on a device or entity is allowed by Dashboard access (Blueprint access for an entity) on it, or by a widget on a Normal or Blueprint dashboard the Run user has Access to that shows it. The AI or Custom Dashboard being viewed never counts, because its layout is not made of widgets the server checks. | The stream rule in the Data permission cell. The grant follows the device, not the variable a widget shows: a device shown by a widget on an accessible Normal or Blueprint dashboard streams every variable the embed subscribes, values included, also variables no widget shows. The watch list from sql.run names only devices and entities the user has Dashboard access or Blueprint access to. |
Titles and text on an AI Dashboard are visible to every user with Access to it, whatever their device permissions. See Data and text visibility, Custom Dashboard in TagoRUN, and Live data in TagoRUN.
AI dashboard generation
The Dashboard resource for Run user Targets has an AI dashboard generation rule. It lets the matched users build and change their personal dashboard on an AI Dashboard, from the prompt bar or the AI chat, and restore or reset it. It matches by ID, tag, or Any like Access, so you can let some users of a dashboard edit while others only view it. The user also needs Access to the dashboard and AI with Access. The rule has no effect on other dashboard types. See Personal AI Dashboards for Run users.
Dashboards for analysis Targets
The Dashboard resource for analysis Targets grants Access, Create, Edit, Delete, and Duplicate on the matched dashboards. Related devices and Related analysis let the Analysis call List Devices related to Dashboard and List Analysis related to Dashboard. The AI Dashboard routes an Analysis can call, and the rule each one needs, are listed in Permissions for an Analysis.
SQL Queries
The SQL Query resource grants actions on TagoSQL stored queries. Run user Targets can be granted Access (list and view queries), Execute (run them), and AI access (let the AI chat discover and run them on the user's behalf); analysis Targets can additionally be granted Create, Edit, and Delete.
Granting execution of a query grants its full result set. The policy decides which queries a caller may run, never which rows or columns come back.
To scope what each Run user sees within a single query, see Session Context. The same scoping applies when the AI chat runs the query; see Restrict AI results with a saved TagoSQL query.
Analysis Endpoints
Call Endpoint on an Analysis lets a Run user or analysis Target call its Endpoint. In With field, match the Analysis by ID, Tag, Tag Match, or Any. The permission applies in both Public and Token modes when a Run user or analysis token is sent. It is separate from Run Analysis.
A Public Endpoint also accepts requests without a token and needs no caller policy for those requests. The Analysis's own resource permissions still control what its code can do.