Users and Permissions¶
Definition¶
Every user has an access level, any number of user roles and any number of user groups. You set permissions on a user role, not on a user, and a user gets them by holding that role.
A user role is a named set of permissions. A user who holds several has the permissions of all of them together.
A user group groups users together. Permissions worded "from Groups" or "of same Group" extend to the users who share a group with the user holding them, which is how one user comes to see or pick another user's cases.
The access level sits above both. A user is subject to every permission, while an administrator sees every case and instance whatever their user roles say.
Permissions¶
| Permission | What it grants |
|---|---|
| View Own Cases | Seeing the cases and instances a user owns, which they can do whether or not it is set |
| View Cases / Instances from Groups | The cases and instances owned by users who share a user group with them |
| View All Cases / Instances | Every case and instance, whoever owns it. Access to the process still applies |
| Create Cases | Starting a new case |
| Delete Cases | Deleting cases. A workflow state can grant this for cases in that state as well |
| Delete Instances | Deleting instances, including the instances an import would delete |
| Import Instances | Importing instances from a file |
| See Case Roles (e.g. Owner) | Seeing who owns a case and who it is assigned to. The Change Case permissions imply it |
| See Instance Roles (e.g. Owner) | Seeing who owns an instance. The Change Instance Owner permissions imply it |
| Change Case Owner to any User | Setting the owner of a case to any active user |
| Change Case Owner to Users of same Group | Setting the owner of a case to a user who shares a group with them |
| Change Case Assignee to any User | Setting the assignee of a case to any active user |
| Change Case Assignee to Users of same Group | Setting the assignee of a case to a user who shares a group with them |
| Change Instance Owner to any User | Setting the owner of an instance to any active user |
| Change Instance Owner to Users of same Group | Setting the owner of an instance to a user who shares a group with them |
| View Case Activity Log | The activity log of a case |
| View Case Error Log | The error log of a case, together with its integration log and diagnostics |
| Resolve Comments | Resolving any comment. Its author and assignee can resolve theirs without it |
| Archive Comments | Archiving any comment. Its author and assignee can archive theirs without it |
| View Configuration | Reading the configuration and changing it |
Example¶
A bank gives every relationship manager the user role "RM", carrying Create Cases and View Cases / Instances from Groups, and puts the managers of each branch into their own user group. A manager then sees the cases owned by anyone in their branch and none from the other branches. Compliance officers hold a second user role carrying View All Cases / Instances, so they see every branch.