# Managing Users

In this section, you will configure Kanoa's security model with different users, roles, and permissions, so the system can support different types of users such as operators, supervisors, engineers, and administrators.

::embed-section{src="../../../configuration/users.md" collapsed="true" summary="Reference Materials: Users - Learn how Kanoa manages users."}

:::action[Create the Scheduler role]
1. Navigate to **Configuration → Users**.
2. On the **Roles** tab, create one custom role with **Role Name** `Scheduler`.
:::

:::action[Set up security for each role]

1. Grant each role the functions shown in the table.

| Role | Configure Security | Configure Assets | Configure Items | Operate Assets | Edit Operations | Schedule Shifts | Schedule Operations | Configure Lots | Configure Quality | Enter Checks | Approve Checks |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Administrator | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Operator |  |  |  | ✓ | ✓ |  |  |  |  | ✓ |  |
| Scheduler |  | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |  |  |  |  |
| Supervisor | ✓ |  |  | ✓ | ✓ | ✓ | ✓ |  |  | ✓ | ✓ |
:::

::::action[Create generic users]

1. On the **Users** tab, create the following users. A first and last name is required for each user.

| User | First Name | Last Name | Password |
|---|---|---|---|
| johnDoe | John | Doe | xxYYzz12345! |
| marcoDiaz | Marco | Diaz | xxYYzz12345! |
| hanaKim | Hana | Kim | xxYYzz12345! |

:::warning[Use complex passwords]
You don't have to use these passwords, just remember that Ignition 8.3 requires complex passwords. You'll want to make a note of your passwords.
:::

::::

:::action[Assign users to roles and assets]

For each assignment in the table below:
1. Double-click the user in the table and select the role tab.
3. Select the asset or assets where the role applies.
4. Save the configuration.

| User | Role | Assets |
|---|---|---|
| johnDoe | Operator | Finishing |
| marcoDiaz | Operator | Philadelphia |
| hanaKim | Scheduler | Philadelphia |

:::

Because role assignments are scoped to assets, `John Doe` can only operate `Manual Pack 1`, while `Marco Diaz` can operate every asset at the Philadelphia site.
`Hana Kim` can schedule across all assets at the Philadelphia site.

:::check

Copy this script into the Ignition Designer Script Console (**Tools → Script Console**) and run it. It checks that the `Scheduler` role exists, that each role has the functions in the table, that each user exists with the right name, and that each user has the right role on the right asset (and no wider). Each check prints PASS or FAIL with what to fix. It doesn't change anything.

<details>
<summary>Show the check script</summary>

::check-script{src="ops/04-managing-users/index.py" title="checkLesson-managingUsers.py"}

</details>

:::