The  access  rights  are  assigned  per  super  user  profile  and  determine  which  user  profile,  which 
parameters (rights at parameter level) or system settings (rights at system level) may change on 
the device. A user of this profile therefore only has access to the corresponding part of the device. 
This provides you with a powerful tool with which you can implement exactly the role concept that 
fits your applications. In the delivery state, all super user profiles are set the same.  
The following figure gives you a first overview: 
 
 
Figure 2.2: Roles and user profiles 
 
All user profiles (exception administrator) are groups of up to nine standard users and one super 
User (su), who manages his group, i.e. he can add or delete users and change user names.  
Users inherit the permissions of their profile. 
Groups of people working with the device should only be provided with the required user profile by 
the administrator after password creation. An example is shown in the table at the end of the section.  
By default, users of profiles 1-5 have read-only access to the enCore device after login. 
To ensure data consistency, only one user can be exclusively logged on to the device at a time and 
changes can only be made after successful login. 
Apart from password protection and access rights, changes can also be prevented by the calibration 
switch (SSW)   or logged in the fiscal audit trail   . The administrator must also make the necessary 
settings  for  this  protection,  which  was  not  installed  on  delivery.  See  also  section  8.3.4  Viewing 
position of the security switch. 
Further information and application about  
user management, logging in, logging out and changing the password, see section 
8.3 User management and login or additional enSuite online help. 
 
In order to ensure the security of your enCore device, you should always give user profiles 1-5 only 
the minimum rights required to perform a task. The following table gives an example overview of a 
few roles and use cases of the permissions proposed by Honeywell: