The degree of control permitted to new users is highly configurable, being split into sections:
View usage log — allows usage logs to be viewed both in summary and in full
Self destruct — allows self-destruction of the device
Set alerting — allows the user to add an email address to which usage alert emails are sent. Note that each individual can configure a separate address for device alerts.
Access control — allows access rules to be specified. These limit, for example, when and where the device can be unlocked.
Set permissions — allows the user to share the device with others and to change what permissions existing users have. Note that allowing a user to set permissions effectively provides them with full and complete control over the device, because they can set permissions for their own account.
Manage certificates — allows the user to permit and revoke trusted computers (computers on which the device can be unlocked without need to access the internet).
The table on this page shows which users the device is shared with, and what permissions they have. To change permissions simply check the relevant boxes and press Submit Changes. To share the device with a new user, click the New User link at the bottom of the table.
Note that clicking New User will by default show a list of all registered users from which a selection can be made. In line with policy, if required, this can instead be configured to show a manual entry box.
If you do not wish to allow users to share control of their devices in this manner, device sharing can be disabled completely in the Administration page.