# User Management Check

<details>
<summary>What is the difference between what Ignition does and what Kanoa does for security?</summary>

Ignition authenticates the user (confirms who they are, via internal user sources, Active Directory, or Identity Providers). Kanoa authorizes the user — it determines what they can do inside Kanoa based on user, role, and asset. See [Managing Users](../04-managing-users/index.md).

</details>

<details>
<summary>tempOperator has the Operator role on the Finishing area only. What happens when tempOperator tries to start a run on Machine 1?</summary>

The run controls are not available. Role assignments are scoped to assets, so tempOperator has Operate Assets rights for `Manual Pack 1` (under `Finishing`) but not for `Machine 1`, which is under `Machining`. Assets outside a user's permissions can still be viewed, but not changed. See [Managing Users](../04-managing-users/index.md) and [Security Functions](../../../configuration/securityFunctions.md).

</details>

<details>
<summary>Who receives Gateway Admin rights, and who can grant them?</summary>

The first user to log into a freshly installed Kanoa MES application automatically receives Gateway Admin rights. Only Gateway Admins can grant Gateway Admin rights to other users. See [Managing Users](../04-managing-users/index.md).

</details>

<details>
<summary>If users come from Active Directory or an Identity Provider, what does Kanoa manage?</summary>

Authentication and user management are generally handled externally; Kanoa manages the user's asset-role associations. With an internal Ignition user source, you can create, edit, and delete users from the Kanoa security table. See [Managing Users](../04-managing-users/index.md).

</details>

<details>
<summary>Your team builds a custom Perspective screen. What security consideration applies?</summary>

Kanoa-provided screens already include security checks, but custom screens may need their own. Screen designers must intentionally apply the same security rules when building custom views. See [Managing Users](../04-managing-users/index.md).

</details>

<details>
<summary>Where is the navigation editor, and how do you hide the Configuration menu from operators?</summary>

**Configuration → Application → Navigation**. Select the **Configuration** item and set its **Roles** so it is visible only to appropriate roles (Administrator, Scheduler, Supervisor — not Operator). See [Navigation Editor](../05-customize-navigation/02-navigation-editor.md).

</details>

<details>
<summary>You've hidden the Configuration menu from operators. Is that what stops an operator from changing asset configuration?</summary>

No. Navigation roles only control which menu items a user sees. What a user can do on a screen is controlled by the functions of their roles on each asset, such as Configure Assets, which each Kanoa view checks. See [Security Functions](../../../configuration/securityFunctions.md).

</details>