Understand and verify access
Organization access is defined in the organization configuration. Local device administration is a separate responsibility.
Check the installed release and the agreed project scope before using a feature.
Who owns each control
| Control | Owner |
|---|---|
| Users, groups, apps and partner access | The organization configuration server stores the approved policy. |
| Published app access | OrendaService derives the local publish rules and allowed identities from that policy. |
| Local services and app sessions | Edge Manager handles Box operations and authenticates app access. |
| PLC and USB resources | The organization grants each resource. The Box checks those grants during gateway sessions. |
Test with separate identities
- Grant a test user access to one resource.
- Confirm that the resource opens and another resource is denied.
- Remove the grant and verify that the user loses access.
- Create a partner link only for the required target and duration. Revoke it and verify denial.
- Record the versions, time and results. Resolve any failure before handover.
Keep the boundary clear
Treat partner links as bearer credentials. Anyone who holds a valid link can use its granted scope. Use named-user access when individual accountability is required.
Keep local pairing private. Do not expose the local service API or remove authentication to solve a connection problem. Check live configuration and target availability first.