Permissions and default profiles

For how profiles and permissions work together, see Permission model. The permissions marked root only below belong to root, which has every permission in every project. See Root, the system administrator.

Permissions

Group	Permission	Key	Allows
Operation	Field writes	canWriteTags	Sending values and commands to the field from runtime screens
	Acknowledge alarm	canAcknowledgeAlarms	Acknowledging, commenting on, shelving and unshelving alarms
	Signal run mode	canSetRunMode	Putting a signal into Manual [SCADA] or Simulated mode
	Take over control	canForceTakeover	Taking control of an area of responsibility without the owner's consent
	Communication control	canControlComm	Starting, stopping and restarting driver communication from the runtime screen
	Approve commands (four eyes)	canApproveCommands	Approving a critical command as the second user, with their own user name and password
	Override electrical interlock	canUnlockInterlock	Forcing a command through an electrical interlock that allows it, with their own password and a reason
	Tag out devices	canTagOut	Hanging a tag on an electrical device and removing their own tag
Engineering	Editor access	canEditProject	Editing screens and the project (root only)
	Configuration editing	canEditConfig	Applying changes in the configuration editor (root only)
	DNP3 administration	dnp3Admin	DNP3 special actions, file transfer and the virtual terminal (root only)
	AI access (MCP)	canUseMcp	Creating their own MCP access key and connecting an AI assistant; the assistant helps only with screen design and configuration and cannot reach the runtime screen (root only)
Administration	Project phase	canSetProjectPhase	Putting the project into the Engineering or Commissioned phase (root only)
	System stop	canStopSystem	Stopping all processes of the project from the runtime screen; starting, stopping and restarting the project from the home page
	User management	canManageUsers	Managing profiles, users and policies; equivalent to an administrator (root only)

Default profiles

YTCC provides nine standard profiles. They are added when user login is turned on for a project.

Permission	pView	pAlarm	pControl	pOperator	pSupervisor	pMaintenance	pEngineer	pSecurity	pAdmin
Field writes			✓	✓	✓	✓	✓		✓
Acknowledge alarm		✓		✓	✓	✓	✓		✓
Signal run mode					✓	✓	✓		✓
Take over control					✓				✓
Communication control					✓	✓			✓
Approve commands (four eyes)					✓				✓
Override electrical interlock					✓				✓
Tag out devices				✓	✓	✓			✓
Editor access							✓		✓
Configuration editing							✓		✓
DNP3 administration						✓	✓		✓
AI access (MCP)							✓		✓
Project phase									✓
System stop									✓
User management								✓	✓

pView can only watch screens, alarms and history. pSecurity manages users, profiles and policies and nothing else, which keeps security administration separate from engineering.

Default user accounts

How user login is turned on decides whether default user accounts are created as well:

• In the New Project window (Enable Auth System), only the profiles are added. The administrator is the user you enter in that window.
• In the configuration editor, turning user login on adds the profiles and one user for each profile. The user name is the profile name without the p, in lower case (pOperator → operator), and the password is the same as the user name. Existing users and profiles are left as they are.

warning

The default accounts have passwords that anyone can guess. Disable the default accounts you do not need and create personal accounts before the project controls a plant.