The short answer: visibility is not permission
As of July 29, 2026, you cannot use Home Assistant's supported user-management screen to securely limit Home Assistant users to certain devices. The normal choices are administrator and non-administrator. A non-admin account leaves configuration and system settings out of the normal interface, but it is not a child, guest, or room-specific security role.
You can build a dashboard for one person and show only the lights, thermostat, or media controls they need. That is good design. It is not a security wall. Home Assistant's dashboard documentation says per-user visibility hides the tab while its direct URL remains accessible. Its security policy goes further: Home Assistant assumes every logged-in user is trusted and does not enforce user privileges as a security boundary.
The practical recommendation is simple: give a regular account to a household member you trust with the home, use kiosk mode to keep an owner-controlled wall tablet easy to operate, and avoid giving a direct Home Assistant login to someone who must be technically prevented from reaching other devices. If a lock, alarm, camera, garage door, or private sensor must remain inaccessible, use that product's documented guest feature or a separate system or account that cannot reach it.
Choose the setup by who will use it
| Person or device | Best practical setup | What it really limits | Main caveat |
|---|---|---|---|
| Trusted adult resident | Personal non-admin account and a tailored dashboard | Keeps configuration and system administration out of the normal interface | Do not assume that omitted devices are technically off-limits |
| Child in the household | Non-admin account only if you trust them with the Home Assistant login; otherwise use physical controls or an owner-controlled tablet | Makes daily controls simpler and reduces accidental changes | A child-specific dashboard changes what is shown; it does not create a real per-device access limit |
| Shared wall tablet | Dedicated non-admin account, simple dashboard, a mode that pins the tablet to Home Assistant, and a device passcode | Keeps casual users inside the intended screen on that physical device | The signed-in account still has its normal Home Assistant access |
| House sitter or neighbor | Use a device maker's official temporary code or sharing feature for the exact lock, camera, or alarm they need | Can isolate access when the product explicitly supports a guest role | Do not replace a narrow guest feature with a broad Home Assistant login |
| Tenant, rental guest, or separate household | A separate Home Assistant installation, separate accounts, and a separate home network | Creates real separation between homes or occupants | More setup and maintenance, but much clearer ownership |
Set up a trusted household account
For a partner, adult family member, or other resident you trust, a regular account is the supported starting point. In Home Assistant, a user is a login; a person is a presence record used to tell whether someone is home. One can exist without the other.
- Open Settings > People, then use the Users tab or allow login for an existing person.
- Leave the Administrator switch off. This keeps integrations—the connections to devices and services—system configuration, user management, and other owner work out of the account's normal screens.
- Create a dashboard from scratch with the rooms and controls that person actually uses. Avoid putting backups, logs, setup tools, or sensitive camera views on a daily household dashboard.
- Sign in as that user on their phone, choose the personal dashboard as the default, and arrange the sidebar for them.
- Test the account yourself from a private or incognito browser window before handing it over. Confirm what search, individual device and control pages, history, maps, and direct dashboard links still reveal.
What “non-admin” means in the house: the normal screens let the person use the smart home without showing integration setup or system settings. Home Assistant still tells owners to treat every logged-in user as trusted. It does not mean “only the five devices shown on this dashboard.”
A hidden dashboard is still not an access rule
Home Assistant lets you make a dashboard view—the tab across the top of a dashboard—visible to selected users. It also lets an administrator mark an entire custom dashboard as admin-only. These tools are useful for keeping a family interface uncluttered.
The important warning appears in the official view documentation: visibility controls whether a tab is displayed, but its direct web address is still accessible. In plain English, hiding the “Security” tab does not prove that the signed-in account cannot reach it another way. Sidebar preferences are also personal display settings, not a lock.
Use view visibility to make the home pleasant to use. Do not use it as the only protection for camera feeds, door locks, alarm controls, occupancy history, energy data, or automations—rules that run actions for you—that can shut down heat, water, or power.
Kiosk mode keeps a tablet focused; it does not limit the account
A shared tablet is different from handing someone a username and password. You control the hardware, the login stays on that device, and the screen can remain on a small household dashboard. That makes a kiosk useful for a kitchen, hallway, guest room, or bedside panel.
On iPhone and iPad, the official Companion app now includes kiosk mode. It can open one dashboard, hide the sidebar and top controls, keep the screen awake, and require Face ID, Touch ID, or the device passcode before someone changes kiosk settings. On Android, the official Home App launcher can make Home Assistant the device's home screen.
Those features contain the experience on that device. They do not change the account behind it. Use a dedicated non-admin login, a device passcode, current operating-system updates, and a dashboard with only low-risk controls. If losing the tablet would expose a dangerous control, the design is too permissive.
Keep high-consequence controls behind a real boundary
Some controls are inconvenient when misused; others can affect safety, privacy, or property. Be conservative with:
- door locks, garage doors, gates, alarm arming, alarm disarming, and access codes;
- indoor cameras, microphones, presence history, maps, and device trackers;
- thermostat limits, freeze protection, water valves, electric-vehicle charging, and whole-home shutdown actions;
- backups, saved app and service sign-ins, remote-access settings, and administrator accounts.
For a house sitter, use the lock maker's temporary PIN, the alarm company's guest code, or the camera platform's documented sharing role when those features exist. Give only the access needed, set an end date, and revoke it afterward. Keep a physical key or manual control path available; a smart-home permission plan should never remove the ordinary way to enter, leave, heat, cool, or make the home safe.
Do not use Trusted Networks as a guest shortcut
Home Assistant's Trusted Networks option is an alternative sign-in method that can skip the normal password prompt on an approved part of your home network. The official documentation warns that, depending on configuration, someone there may be able to choose a username without entering its password. The extra login check known as multi-factor authentication also does not take part in that login path.
That can be convenient for a carefully managed local display. It is a poor substitute for a guest role—especially on Wi-Fi shared with visitors. If you use it at all, keep the normal username-and-password sign-in method as a fallback, limit the network and selectable user precisely, and never make the owner account the easy choice on a shared network.
Why the documentation can look contradictory
Four different parts of Home Assistant describe four different layers:
| Documentation layer | What it says | What a homeowner should conclude |
|---|---|---|
| User accounts | Accounts are administrators or non-administrators | Use non-admin for normal residents, but do not expect room-by-room roles |
| Dashboards | Views can be shown to selected users, while direct paths remain accessible | Visibility changes what is shown; it does not create a real access limit |
| Developer permissions | The code has permission checks for entities—the individual controls and readings inside Home Assistant | The underlying software can check permissions, but the regular settings do not offer a custom per-device role editor |
| Security policy | Logged-in users are assumed to be trusted | Do not give a direct login to someone who must be isolated from the rest of the system |
Do not edit Home Assistant's internal storage files to force a custom permission policy. That turns a household access question into an unsupported maintenance and recovery problem.
Test access before someone needs it
- Write down the exact job. “Turn on the guest-room lamp” is safer than “use the smart home.”
- Classify the person. Trusted resident, supervised child, shared-display user, temporary helper, and tenant are different cases.
- List sensitive controls. Include cameras, locks, alarms, location, garage doors, heating and cooling, water, power, and account settings.
- Choose the narrowest supported path. Prefer physical controls or a product's guest feature when a direct Home Assistant login is broader than the job.
- Test from a clean session. Use the real non-admin account on another browser or device and try navigation, search, history, direct links, and remote access.
- Plan removal. Record which login, PIN, share, or device must be revoked and when.
Tara's practical approach to shared-home control
A usable smart home should not require every visitor to become an administrator. Start with ordinary switches and clear room controls, then add a simple interface for people who live there. Tara's wall-tablet setup guide covers the dedicated-display details, while the remote-access guide explains safe access away from home.
For a new installation, document who owns each account, which controls are sensitive, and what works when the app is unavailable. A configured Home Assistant-style smart home should include that household handoff, not just a dashboard that looks finished.
Frequently asked questions
Can a non-admin Home Assistant user control every device?
The normal non-admin interface leaves out integration and system settings, but Home Assistant's security policy says every logged-in user must be treated as trusted. Its supported user screen cannot securely assign only selected devices to one person.
Can I show one Home Assistant dashboard to one user?
Yes. You can make dashboard views visible to selected users and set a personal default dashboard. The visibility setting hides the tab; it does not make the direct URL inaccessible.
Does Home Assistant kiosk mode restrict device access?
No. Kiosk mode keeps a phone or tablet focused on one dashboard and can hide navigation. It does not change the permissions of the signed-in Home Assistant account.
Can I create a guest account in Home Assistant?
You can create a user-only account and name it for a guest or kiosk, but it is still a regular account. Home Assistant does not turn that name into a special guest role with per-device limits.
Should I use Trusted Networks for guest access?
Usually no. Trusted Networks can allow passwordless account selection from an approved network. That is convenient on a tightly controlled display network, but it does not create a limited guest role.