About
Role-based access control for Home Assistant: roles x areas x view/operate/change, enforced on native HA group permissions (no core fork).
Description from NoSilver78/tessera
Installs over time
#1,545 of 1,557 Marketplace integrations. Installs sharing analytics.
Supports
- Works locallyTalks to your devices on your own network. No vendor cloud in between.
- From the MarketplaceInstalled through the Marketplace, formerly HACS.
- Actively maintainedIts author released or pushed a change in the last six months.
Setting it up
Install it from the Marketplace and restart Home Assistant, then add it under Settings, Devices and services.
After setup
- Action
- Mode
- Role id
- Name
- Description
- Role
- Area
- Role
- Read
- Control
- Grant
Texts from the code of NoSilver78/tessera.
Actions
- RecompileRecompiles every loaded Tessera entry for its current mode: a read-only preview in off/monitor, or a native re-apply (writes the auth store) in enforce. Admin-only; takes no input.
- Acknowledge componentAcknowledge a custom component so its D9 conflict-veto is overridden for the current installed version (admin-only; the ack auto-invalidates if the component changes).
- Domain
- Revoke component acknowledgementRevoke a D9 custom component acknowledgement and immediately recompile Tessera's current mode.
- Domain
- Set membershipAssign Tessera roles to one Home Assistant user. Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
- User id
- Role ids
- Set floor grantGrant or remove a Tessera role's read/control access for every entity on a Home Assistant floor. Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
- Floor id
- Role id
- Read
- Control
- Set label grantGrant or remove a Tessera role's read/control access for every entity carrying a Home Assistant label (the entity itself, its device, or its area). Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
- Label id
- Role id
- Read
- Control
- Import modelProvision the whole Tessera model in one declarative, idempotent call: each provided dimension replaces that dimension, omitted ones are preserved. Mode and D9 acks are never changed. Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
- Roles
- Memberships
- Area grants
- Floor grants
- Entity overrides
- Label grants
- Preflight (enforce readiness)Read-only dry run of the enforce pipeline: returns whether enforce would succeed, the full D9 component breakdown (which custom components would veto and why), cross-role linter conflicts, and a model summary. Writes nothing and never changes mode. Admin-only.
- Set modeSet Tessera's operating mode: off restores managed native auth state and stops, monitor compiles a read-only preview, enforce applies managed native auth after all gates pass. Admin-only. Routes through the same guarded apply path as setup, so entering enforce applies live and leaving it restores the pre-install snapshot.
- Mode
Troubleshooting
- Repair noticesNotices it can show in Settings, Repairs:Tessera fell back to monitor mode, Tessera restore needs attention
From the README
Role-based access control (RBAC) for Home Assistant — Read / Control × Role × Area.
Tessera is a standalone permission system for Home Assistant. It closes a gap that has been open for years: HA only has three fixed system groups, no UI for fine-grained rights, and a hard owner bypass. Tessera compiles declarative policies (role × area × action) into native HA PolicyPermissions and writes them — in enforce mode — into the Home Assistant auth store. No monkeypatch, no core fork.
Information
- Installs
- 50 sharing analytics
- GitHub stars
- 1
- Connection
- Works locally
- Upkeep
- Updated in the last 6 months
- Version
- v0.9.4,
- Category
- Security and safety, Locks and access
- Kind
- Marketplace integration
- Needs
- Needs the Marketplace (HACS on 2026.10 and older)
- Domain
tessera- Issues
- Report an issue
