I stayed in a hotel a while ago where every room had a touch screen running Home Assistant (this one). Nice setup, until I realised I could control every other room from mine. Lights, blinds, aircon, and the common areas too.
That’s not really their fault. Home Assistant doesn’t give you a way to do it properly. You’re either an admin or you’re not, and that’s the whole permission system. A non-admin still sees every camera, every lock, every sensor. Same reason I couldn’t give a guest a dashboard with just the lights on it, or give my kid a tablet that can’t open the front door.
You make roles and hand them out. Per role you pick:
- which entities they can see and control, by area, domain, label, floor, or one specific thing
- which attributes to hide, like
latitudeon people, the code a lock exposes, IP addresses, serial numbers - which dashboards, add-ons and screens show up in their sidebar
- whether they can get at settings at all
Hidden actually means hidden. The entity isn’t greyed out, it’s just not there: not on the dashboard, not in search, not in history, not in the API. And there’s a log of everything it refused, so when someone says “it stopped working” you can see what and why.
It’s all in a normal panel. No YAML.
It works by sitting in front of the API and filtering, so it doesn’t patch anything or touch your config. The bit I like is that it doesn’t ship a list of what’s dangerous. Home Assistant already marks its own admin commands and this reads those markings live on your instance, so it doesn’t go stale every release.
Two things before you try it. Home Assistant has to stop answering directly, so you set the server host to 127.0.0.1 under Settings > System > Network and let this answer on 8123 instead. Skip that and it does nothing, because anyone can just go round it with the token they already have. And it won’t save you from someone with a shell on the machine, or from an add-on that has API access.
It’s an alpha. It’s tested and I’ve spent a while trying to break it, including on a real Supervised box with add-ons installed, but it hasn’t lived in anyone else’s house yet. Don’t make it the only thing between someone and your front door.
If you do try it, the report I actually want is “my dashboard broke, here’s what the Denials tab said”.
HACS, as a custom repository.