Roles and Permissions

Roles control what users can access and do within the system. This guide explains how roles work and how to manage them effectively.

Understanding Roles

What is a Role?

A role is a collection of permissions that define what a user can do. Instead of assigning individual permissions to each user, you assign roles that bundle related permissions together.

Benefits of role-based access:

• Easier to manage than individual permissions
• Consistent access levels across users
• Simpler onboarding and offboarding
• Clear audit trail of who can do what

Role Hierarchy

Roles in the system are organized by scope:

System Roles (Global Access)
├── Super Admin
├── Developer
└── User Manager

Module Roles (Feature-Specific)
├── Monitoring Roles
├── Inventory Roles
└── Other Module Roles

Organization Roles (Scoped to Organization)
└── Roles assigned with specific organization context

System Roles

These roles provide system-wide access and administrative capabilities.

Super Admin

Super Admin can:

• Access all modules and features
• Manage all users and roles
• Configure system settings
• View all organization data

User Manager

User Manager can:

• Create and edit user accounts
• Enable and disable users
• Assign and remove roles
• View user activity logs

Developer

Developer can:

• Access web terminal
• View system logs
• Debug application issues

Module Roles

Each module has its own set of roles that control access to that module's features.

Budget Proposal Roles

Monitoring Roles

Inventory Roles

HR Roles

ORS Roles

Portal Roles

Organization-Scoped Roles

Some roles can be assigned with an organization scope, meaning the user only has that role's permissions within a specific organization and its sub-organizations.

How Organization Scoping Works

Example: User assigned "ORS Treasury" for "Finance Department"

Can access:
├── Finance Department
├── Accounting Division (sub-unit of Finance)
└── Budget Division (sub-unit of Finance)

Cannot access:
├── Operations Department
└── Human Resources Department

When to Use Organization-Scoped Roles

Viewing Roles

Role List

Navigate to Control Center > Roles to see all available roles:

• Role name
• Description
• Number of users with this role

Searching Roles

Use the search box to filter roles by name or description.

Assigning Roles to Users

From the User Profile

1. Go to Control Center > Users
2. Select the user
3. Click Assign Role
4. Choose the role
5. (Optional) Select organization scope
6. Click Assign

Understanding the Assignment Form

Removing Roles from Users

1. Open the user's profile
2. Find the role in the Assigned Roles section
3. Click the remove button
4. Confirm the removal

Warning: Removing a role immediately revokes the associated permissions. The user may lose access to features they were using.

Role Assignment Best Practices

Principle of Least Privilege

Assign users only the roles they need to perform their job functions.

Role Assignment Guidelines

1. Start minimal - Begin with the minimum required role
2. Add as needed - Expand access based on demonstrated need
3. Review regularly - Audit role assignments periodically
4. Document reasons - Keep records of why roles were assigned

Common Role Combinations

Role Changes and Transitions

When an Employee Changes Departments

1. Review current role assignments
2. Remove organization-scoped roles for old department
3. Assign organization-scoped roles for new department
4. Verify the user can access needed features

When an Employee Gets Promoted

1. Review new responsibilities
2. Assign additional roles as needed
3. Consider removing roles no longer applicable
4. Document the changes

When an Employee Leaves

1. Disable the user account
2. Do NOT remove roles (preserves audit trail)
3. The disabled account retains role history for reference

Troubleshooting Access Issues

User Can't Access a Module

Check:

1. Does the user have the required role?
2. Is the role organization-scoped correctly?
3. Is the user account enabled?
4. Has the user logged out and back in after role changes?

User Has Too Much Access

Actions:

1. Review all assigned roles
2. Remove unnecessary roles
3. Consider using organization-scoped roles
4. Audit what the user has accessed

Role Changes Not Taking Effect

Solutions:

1. Have the user log out and log back in
2. Clear browser cache
3. Verify the role was actually saved
4. Check for conflicting role assignments

Security Considerations

High-Risk Roles

These roles should be assigned sparingly:

Audit Recommendations

1. Monthly review - Check who has high-risk roles
2. Access logging - Monitor what privileged users do
3. Separation of duties - Avoid giving one person all administrative roles
4. Emergency access - Have a documented process for emergency access needs

Role Assignment Audit Questions

When reviewing role assignments, ask:

1. Does this user still need this role?
2. Is the organization scope still appropriate?
3. Has the user's job function changed?
4. Are there any redundant role assignments?
5. Is anyone using roles they shouldn't have?