Roles and permissions

A role is the baseline. It decides which parts of the portal a user sees at all, and you assign it from the role itself, in its Users tab, rather than from the person.

That is worth getting used to, because it also tells you how to take it away again. You remove the user from the role, and the access goes with it.

Permissions on the employee record are the fine adjustment on top. Anything the role already grants is locked there, so you can only set what the role leaves open. If a permission looks greyed out on a user, the answer is not on that screen, it is in the role.

Three of them change more than they appear to.

Access to the entire marketplace ignores whatever you enabled for self service and opens the full catalogue. Useful for IT staff, surprising if you forget it is on.

Record service instances and inventory creates active services without approval, ordering or fulfilment. That is what you want when entering existing stock, and not what you want as a standing right.

Remove service instances and inventory deletes an active service without deprovisioning it. High impact, keep it with the few people who understand the consequences.

The rest, self service, showing prices and costs, and employee access for a location manager, are everyday settings you can hand out without much thought.

The other way round: starting from the user

The same result can be reached from the employee record, through its Permissions tab. Nothing behaves differently, it is the same rights seen from the other end.

Which route to take depends on the question you are answering. Starting from the role is right when you are deciding how a group of people should work: every controller, every location manager, everyone in support. Starting from the user is right when one person needs an exception, or when someone asks why they cannot see something and you want the answer for them specifically.

The second route is also the faster way to understand what a person actually has, because role based rights and individual ones sit on the same screen there, the locked ones coming from the role and the open ones you can still set.

Read more

Roles and rightsRole OverviewIndividual Permissions for Employees

Next

One more way to organise people: Groups.