Access policy

By default every employee can pair their phone and gets their own permissions on it. If the company needs it otherwise, this is decided by the organisation owner on buff.systems or by the administrator of a Buff Community or Enterprise installation.

An organisation on buff.systems

The organisation owner opens “Settings → Phone” in the workspace and sees, besides their own, “Organisation’s phones” — all employees’ phones: who paired them and when, when they were last online. Any of them can be disconnected.

The same place has the ban on phones in the organisation. After confirmation (“Forbid phones?”) new phones cannot be paired, and those already paired are disconnected at once: the connection is broken, and the organisation’s data is wiped from the phones. The ban also applies to the Buff Code of employees signed in to this organisation. The ban can be lifted in the same place; the phones then have to be paired again.

Buff Community and Enterprise

The installation’s admin panel has a “Mobile app” section:

• “Mobile access is on” — the main switch. When it is off, the installation does not register at the gateway: phones do not see it and new ones cannot be paired. Existing pairings are not broken — turn access back on, and the paired phones are online again.
• “Who can pair phones” — “All employees”, “Roles only” (choose the roles) or “Forbidden to employees”. With “Roles only”, the installation owner can pair their own phone even without a role from the list. “Forbidden to employees” closes pairing to everyone, including the owner, and phones already paired are disconnected.
• “Push notifications” — “Via buff.systems” or “Off”. When off, no notifications go to phones at all; what is waiting for an employee is visible in the app. More in Notifications.
• “Employees’ phones” — all paired phones, with a “Disconnect” button.
• “Buff Code signed in to the installation” — employees’ machines that this policy also applies to, and how many phones are paired with each.
• “Log” — who changed what and when: pairings, disconnections, policy changes.

Changes take effect within half a minute. A disconnected phone loses the connection at once and wipes this installation’s data as soon as it is online.

The phone’s permissions

The policy decides whether a phone can be paired. What can be done from the phone is decided by the employee’s ordinary permissions in the installation: the phone acts on their behalf and cannot do more than they can in the workspace.