---
title: "Tessera"
description: "Tessera is a Marketplace integration for Home Assistant. It has 50 installs sharing analytics, works locally and was last updated October 25, 2026."
canonical: "https://vulpo.app/integrations/marketplace/nosilver78-tessera"
url: "https://vulpo.app/integrations/marketplace/nosilver78-tessera.md"
last-updated: "2026-11-10"
version: "1.4"
---

# Tessera

> Tessera is a Marketplace integration for Home Assistant. It has 50 installs sharing analytics, works locally and was last updated October 25, 2026.

From the [repository description](https://github.com/NoSilver78/tessera):

> Role-based access control for Home Assistant: roles x areas x view/operate/change, enforced on native HA group permissions (no core fork).

[Open in My Home Assistant](https://my.home-assistant.io/redirect/marketplace_repository/?owner=NoSilver78&repository=tessera&category=integration)

On Home Assistant 2026.10 or older? [Open it in HACS](https://my.home-assistant.io/redirect/hacs_repository/?owner=NoSilver78&repository=tessera&category=integration)

## Supports

- **Works locally**: Talks to your devices on your own network. No vendor cloud in between.
- **From the Marketplace**: Installed through the Marketplace, formerly HACS.
- **Actively maintained**: Its author released or pushed a change in the last six months.

## Setting it up

Install it from the Marketplace and restart Home Assistant, then add it under Settings, Devices and services.

### After setup

- **Action**
- **Mode**
- **Role id**
- **Name**
- **Description**
- **Role**
- **Area**
- **Role**
- **Read**
- **Control**
- **Grant**

Texts from the code of [NoSilver78/tessera](https://github.com/NoSilver78/tessera).

## Actions

- **Recompile**: Recompiles every loaded Tessera entry for its current mode: a read-only preview in off/monitor, or a native re-apply (writes the auth store) in enforce. Admin-only; takes no input.
- **Acknowledge component**: Acknowledge a custom component so its D9 conflict-veto is overridden for the current installed version (admin-only; the ack auto-invalidates if the component changes).
  Fields: Domain
- **Revoke component acknowledgement**: Revoke a D9 custom component acknowledgement and immediately recompile Tessera's current mode.
  Fields: Domain
- **Set membership**: Assign Tessera roles to one Home Assistant user. Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
  Fields: User id, Role ids
- **Set floor grant**: Grant or remove a Tessera role's read/control access for every entity on a Home Assistant floor. Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
  Fields: Floor id, Role id, Read, Control
- **Set label grant**: Grant or remove a Tessera role's read/control access for every entity carrying a Home Assistant label (the entity itself, its device, or its area). Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
  Fields: Label id, Role id, Read, Control
- **Import model**: Provision the whole Tessera model in one declarative, idempotent call: each provided dimension replaces that dimension, omitted ones are preserved. Mode and D9 acks are never changed. Admin-only; in enforce mode this recompiles through Tessera's guarded apply path.
  Fields: Roles, Memberships, Area grants, Floor grants, Entity overrides, Label grants
- **Preflight (enforce readiness)**: Read-only dry run of the enforce pipeline: returns whether enforce would succeed, the full D9 component breakdown (which custom components would veto and why), cross-role linter conflicts, and a model summary. Writes nothing and never changes mode. Admin-only.
- **Set mode**: Set Tessera's operating mode: off restores managed native auth state and stops, monitor compiles a read-only preview, enforce applies managed native auth after all gates pass. Admin-only. Routes through the same guarded apply path as setup, so entering enforce applies live and leaving it restores the pre-install snapshot.
  Fields: Mode

## Troubleshooting

- **Repair notices**: Notices it can show in Settings, Repairs:
  Tessera fell back to monitor mode, Tessera restore needs attention

## From the README

> Role-based access control (RBAC) for Home Assistant — Read / Control × Role × Area.
>
> Tessera is a standalone permission system for Home Assistant. It closes a gap that has been open for years: HA only has three fixed system groups, no UI for fine-grained rights, and a hard owner bypass. Tessera compiles declarative policies (role × area × action) into native HA PolicyPermissions and writes them — in enforce mode — into the Home Assistant auth store. No monkeypatch, no core fork.

From the README of [NoSilver78/tessera](https://github.com/NoSilver78/tessera#readme), [MIT License](https://spdx.org/licenses/MIT.html). Shortened.

## At a glance

- Kind: Marketplace integration
- Category: [Security and safety](https://vulpo.app/integrations/category/security-and-safety.md), Locks and access
- Number: 50 installs sharing analytics; 1 GitHub stars
- Connection: Works locally
- Upkeep: Updated in the last 6 months
- Needs: Needs the Marketplace (HACS on 2026.10 and older)
- Latest version: v0.9.4, last updated October 25, 2026
- Domain: `tessera`
- Source: <https://github.com/NoSilver78/tessera>
- Issues: <https://github.com/NoSilver78/tessera/issues>

Independent directory, made by the developer of Vulpo. Not affiliated with Home Assistant or the Open Home Foundation. [About these numbers](https://vulpo.app/integrations/about)

Last updated 2026-11-10. Source: https://vulpo.app/integrations/marketplace/nosilver78-tessera

---

- HTML version of this page: https://vulpo.app/integrations/marketplace/nosilver78-tessera
- Site index for agents: https://vulpo.app/llms.txt
- Everything in one document: https://vulpo.app/llms-full.txt
- All pages: https://vulpo.app/sitemap.xml