Role-Based Access Control in Energy Management Platforms

When six people share one login to your energy management system, you lose more than security—you lose accountability. You cannot tell who entered incorrect consumption data, who dismissed a critical alert, or who exported sensitive cost figures to an unauthorized recipient. In multi-property Canadian commercial operations where energy data feeds financial reporting, ESG disclosures, and operational decisions, controlling who sees and does what is a business requirement—not an IT nice-to-have.

Role-based access control (RBAC) assigns permissions based on job function rather than individual negotiation. This guide explains why access control matters in energy management, how RBAC works in practice, the three core roles every platform should support, and how to implement permissions that match your team structure without creating unnecessary complexity.

Why Access Control Matters in Energy Management

Energy management platforms hold sensitive operational and financial data: utility costs, consumption patterns, tenant allocation details, capital project ROI analyses, and carbon emissions figures used in ESG reporting. Uncontrolled access creates risks beyond conventional cybersecurity concerns:

• Data integrity — Unauthorized edits corrupt benchmarks, forecasts, and savings calculations
• Accountability gaps — Shared logins make it impossible to trace who entered or modified records
• Operational confusion — Property managers seeing portfolio-wide data they do not control creates noise; executives drowning in interval-level detail miss strategic signals
• Compliance exposure — ESG disclosures and regulatory reporting (Ontario EWRB, municipal building performance standards) require auditable data provenance
• Tenant trust — Sub-meter chargeback data shared inappropriately damages landlord-tenant relationships

RBAC addresses each risk by ensuring every user sees the data relevant to their role and can perform only the actions their responsibilities require.

What Is Role-Based Access Control in the Energy Management Context?

Role-based access control assigns permissions to roles—Admin, Manager, Viewer—rather than configuring individual user permissions from scratch. When a new facility manager joins, you assign the Manager role scoped to their properties. They immediately receive appropriate dashboard access, data entry rights, and alert notifications without custom configuration.

RBAC differs from simple password protection. A login credential authenticates identity; roles authorize actions. Together, they ensure that authenticated users can only view and modify data within their defined scope.

In multi-user energy management platforms like Energy Wiz, RBAC extends across properties, features, and data types—controlling not just whether a user can log in, but which buildings they see, whether they can enter data, and whether they can modify system settings.

The Three Core Roles and What They Should See

Energy Wiz implements three roles designed to match typical Canadian commercial and industrial team structures. Understanding each role's scope helps you map organizational responsibilities to platform permissions.

Admin Role: Full Access

Admins hold organization-wide authority. Typical users include energy managers, sustainability directors, and IT administrators responsible for platform configuration.

• View all properties and portfolio-level dashboards
• Enter, edit, and delete energy data across all accounts
• Configure alert thresholds and notification routing
• Manage user accounts, roles, and property assignments
• Generate and export all report types (PDF, CSV, Excel)
• Modify organization settings, utility rate structures, and targets
• Access forecasting, cost simulation, and Intelligence Hub features

Manager Role: Operational Oversight

Managers handle day-to-day energy operations for assigned properties. Typical users include facility managers, property managers, and regional operations leads.

• View dashboards and data for assigned properties only
• Enter and edit utility data for their properties
• Receive and respond to alerts for assigned sites
• Generate property-level reports
• Upload CSV data and process bill images for their accounts
• Cannot modify organization settings or manage other users

Viewer Role: Read-Only Access

Viewers consume information without modifying data. Typical users include executives, CFOs, external auditors, tenant representatives, and board members reviewing ESG performance.

• View dashboards and reports for assigned properties or portfolio summaries
• Access shared dashboards and benchmarking comparisons
• Export reports if permitted by organization policy
• Cannot enter data, modify settings, or manage alerts

Principle of least privilege—giving users the minimum access required for their role—is the foundation of effective RBAC in energy management platforms.

Why Different Roles Need Different Data Views

A CFO reviewing quarterly portfolio performance needs cost intensity trends and year-over-year savings—not 15-minute interval charts for a single HVAC system. A facility manager responding to a consumption alert needs property-specific detail—not portfolio-wide rankings. A tenant reviewing sub-meter chargeback data needs their unit's consumption—not neighbouring tenant figures.

RBAC ensures each stakeholder receives the view matched to their decision scope. This reduces cognitive load, prevents accidental modifications by users who should only observe, and speeds response by routing operational alerts to Managers rather than broadcasting to every organizational user.

Tenant and Third-Party Access: Sharing Data Without Oversharing

Commercial landlords increasingly share energy data with tenants as part of green lease provisions, ENERGY STAR tenant recognition programs, and sub-meter chargeback transparency. RBAC enables this without exposing sensitive portfolio information.

Create Viewer accounts scoped to individual tenant spaces or sub-metered units. Tenants see their consumption, cost allocation, and benchmark context—without access to other tenants' data, landlord cost structures, or portfolio-wide financial summaries. For commissioning contractors, grant temporary Manager access to assigned properties with a defined end date.

This controlled sharing supports collaboration while maintaining data boundaries that protect competitive and financial information.

Audit Trails and Accountability

When each user operates under an individual account with a defined role, every data entry, modification, and export links to an identified person and timestamp. Audit trails serve multiple purposes:

• Data quality investigation — Trace incorrect entries to their source for correction and retraining
• ESG reporting integrity — Demonstrate to auditors that consumption figures were entered by authorized personnel
• Alert response accountability — Verify that facility managers acknowledged and acted on consumption anomalies
• Change management — Review who modified alert thresholds or target settings when performance expectations shift

Shared logins destroy audit trail value entirely. If three people use one Admin account, an erroneous data deletion is untraceable.

RBAC and Multi-Property Organizations

Portfolio scale amplifies RBAC importance. A twenty-property REIT may have two Admins at corporate, eight regional Managers each overseeing two to four properties, and Viewer access for asset management executives and external sustainability consultants.

Property-scoped Manager roles ensure a facility manager in Calgary sees Alberta assets without accessing Ontario properties outside their responsibility. Central Admins maintain portfolio-wide visibility for benchmarking and capital prioritization described in our guide to managing energy across a property portfolio.

As portfolios grow, RBAC prevents the common failure mode where either everyone sees everything (creating noise and security risk) or access is so restricted that operational teams cannot enter data for their own buildings.

Security Considerations for Energy Data

RBAC is one layer in a broader security approach for energy management platforms:

• Individual credentials — Never share logins; deactivate departed employee accounts immediately
• Session management — Automatic timeout on mobile and web sessions reduces unattended access risk
• Data encryption — Energy data encrypted in transit and at rest protects utility cost and consumption information
• Two-factor authentication — Add 2FA for Admin accounts as a baseline security control
• Quarterly access review — Verify that role assignments still match current job responsibilities

Energy data may not seem as sensitive as financial systems—but utility costs, tenant allocations, and operational patterns reveal competitive information worth protecting.

Practical Implementation: Setting Up Roles for Your Team

When onboarding a new energy management team, map roles before inviting users:

1. Identify who holds Admin responsibility (typically one to two people)
2. List each property and its assigned Manager
3. Define Viewer recipients: executives, finance, auditors, tenants
4. Create accounts with appropriate roles and property scopes
5. Document the access matrix in your energy program governance records
6. Review and update quarterly as team members change

Align role setup with your team structure as described in our guide to building an energy management team. Roles should mirror organizational reality—not an ideal hierarchy that nobody follows.

Role Comparison Matrix

Reliable data collection practices—manual entry, CSV upload, or automated feeds—depend on Managers entering data correctly under accountable individual accounts. See our guide to energy data collection methods for the data workflows each role supports.

Conclusion

Role-based access control transforms energy management platforms from single-user spreadsheets into collaborative systems that scale across teams, properties, and stakeholders. Admin, Manager, and Viewer roles map directly to the responsibilities found in Canadian commercial energy programs—central coordination, local operations, and executive oversight.

Implement RBAC when you onboard your team, not after a data integrity incident forces the conversation. Individual accounts, property-scoped permissions, and audit trails protect data quality, support compliance reporting, and ensure the right people see the right information at the right time.

Energy Wiz builds RBAC into its multi-user collaboration features so Canadian commercial and industrial teams can manage energy together—with clarity, accountability, and security from the first property added to the portfolio.