Granular Role Permission for Device-Level Converge (Without Group-Level Access): Not Yet Supported

Android

Esper's role-based access control (RBAC) system does not currently support separating device-level Blueprint converge permissions from group-level converge permissions. This article explains this limitation and describes your options.

Understanding the limitation

You may want to allow certain support representatives to apply a Blueprint to individual devices during support calls, while preventing them from triggering a group-level converge that would push configuration changes to all devices in a group at once.

Currently, Esper's custom role and permission system treats converge as a single permission that applies across both scopes—individual device and group. There is no way to grant access to Devices & Groups → [Device] → Blueprint → Converge while blocking Devices & Groups → [Group] → Blueprint → Converge.

What you can do now

While Esper does not support this granular permission split, you have one architectural option:

• Place each device into its own single-device group. This limits the blast radius of a group-level converge to a single device. However, this approach has significant operational overhead at scale and should only be used as a last resort if your security or compliance requirements make it necessary.

Request this feature

To help Esper prioritize this capability, contact Esper Support and describe your use case. Include:

• Your specific need for device-level converge access without group-level access
• How many users or roles require this permission split
• Whether this is blocking production operations or represents a compliance requirement

Esper's product team reviews feature requests to prioritize future development.

Still need help?

If you have questions about custom roles, RBAC configuration, or alternative permission structures, submit a support ticket. Be sure to include details about your use case and current role configuration.