Create, tailor or retire a role

A role is a named bundle of permissions: for each module (Projects, Bookings, Demands, Vouchers and so on) it says whether its holders may view, create, edit or delete, and do the special actions such as approve, issue or post. Every user holds one role. NirmaanOne comes with twelve default roles, from Administrator to Front Desk; this guide tailors one of them, makes a new one, retires one you no longer need, and gives it to people.

Before you start

• Permissions, in the role editor's words: the View permission on Roles & Permissions to see roles, the Create permission to make or clone one, the Edit permission to change, deactivate or reactivate one, and the Delete permission to delete one. Giving the role to a user needs the Edit permission on Users. In the default roles only the Administrator can create, change or delete a role; most other default roles can view the list.
• Decide whether to start from scratch or from a copy. The default roles (Finance Lead, Project Manager, Accountant, Sales Manager, Compliance Officer, Auditor, Rehab Officer, Sales Executive, Site Engineer, Front Desk, Legal & Documentation) are a good starting point: clone the nearest one and adjust it.
• The Administrator role is locked: it always holds every permission and can be cloned, but not changed, deactivated or deleted.

Steps

1. Open the account menu in the top bar, choose Settings, then the Roles & Permissions tab (Roles & Permissions). The page reads "Roles bundle permissions per module. Default roles can be tailored or deactivated but not deleted; Administrator is locked." Each role is marked Locked, Default or Custom, with its Permissions and Users counts.
2. To make a role from scratch: click New role. The New role page opens: "Name the role and tick what it may do in each module."
3. Type the Role name (2 to 100 characters, for example "Site Accountant") and, if you like, a Description, which shows on the list.
4. In Permissions, tick what the role may do. Each row is a module with a box per action: View, Create, Edit, Delete, then the special actions (Approve, Issue, Post, and "publish" and "send" where a module has them); "·" means the module has no such action. A module's All box ticks its whole row, and a group's All box ticks every module in the group. Select all and Clear act on the whole grid. The counter reads "<n> of <N> selected".
5. Click Create role. You see 'Role "<name>" created.' and you are back on the list, where the new role shows as Custom.
6. To start from an existing role instead: on the list, click the copy icon on its row (tooltip "Clone"). The dialog "Clone role" asks for the Name for the copy of <role> ("<role> (copy)" to start) and says "The copy starts with the same permissions; you can edit it next."
7. Click Create copy (greyed out until the name has at least 2 characters). You see 'Role "<name>" created from a copy.' and the new role's page opens, described as "Copy of <role>".
8. To tailor a role, on its page (the copy you just made, or a default role opened by clicking its name) change the ticks as in step 4, and the Role name or Description if needed. A default role's page says "A default role: tailor its permissions to your organization. It can be deactivated but not deleted." Click Save role. You see 'Role "<name>" updated.' and you are back on the list.
9. To retire a role, click the ban icon on its row (tooltip "Deactivate"). The dialog "Deactivate role?" says "Users holding <role> lose its permissions immediately. The role keeps its settings and can be reactivated later." Click Deactivate. You see 'Role "<name>" deactivated.' Tick Show inactive roles to see it again, marked Inactive; the refresh icon (tooltip "Reactivate") brings it back.
10. To remove a custom role for good, click the trash icon on its row (tooltip "Delete"). The dialog "Delete role?" says "<role> will be removed permanently. Roles still held by users cannot be deleted." Click Delete. You see 'Role "<name>" deleted.'
11. To give the role to people, open Settings > Users, click the pencil on each person's row (tooltip "Edit role & access"), choose the role in Role and click Save changes. You see "<email> updated." See Change a user's roles, or deactivate a user. A new person gets the role when you invite them (see Invite users and get them signed in).

What happens next

• Changes reach people within about 15 minutes. A user's permissions are refreshed when their session is next renewed, or at once if they sign out and in again. The same applies to a deactivated role, even though its dialog says "immediately".
• A deactivated role grants nothing. Its holders keep it on their record but have no permissions from it, so they can do almost nothing until you give them another role. It can't be given to anyone while it is inactive.
• Who holds a role is listed in the Members card on the role's page ("Nobody holds this role yet." when empty), with the link "Assign or remove this role per user from Users."
• Every change is on record. The History button on the role's page shows who changed its name or permissions and when; permissions added and removed appear as lines of the role. See History panel.
• Automations follow their owner's permissions. If you take a permission away from the role of someone who switched on a workflow rule, that rule's runs fail until someone with the permission switches it on again.
• Tailored default roles may be topped up. When whoever maintains the server reseeds the default settings, any permission a default role is meant to have is granted again, and a default role you renamed is created afresh under its original name. To keep a reduced set of permissions for good, clone the default role and tailor the copy.

If something goes wrong

• "A role with this name already exists." under Role name or in the clone dialog: role names are unique in your organization, whatever the capitals. Choose another. See Already exists.
• Delete answers "Default roles cannot be deleted. Deactivate the role instead.": only custom roles can be deleted. See Role cannot be deleted, renamed or assigned.
• Delete answers "Users still hold this role. Reassign them or deactivate the role instead of deleting it.": give those users another role first (step 11), or deactivate it. See Role cannot be deleted, renamed or assigned.
• The Administrator's page is read-only ("Administrator always holds every permission and is kept in sync by the system."): clone it if you want a near-administrator role you can adjust.
• The New role button, the icons or Save role aren't there: you lack the matching permission on Roles & Permissions. See No access or no permission.

Related

• Roles & Permissions
• New role
• Edit role
• Users
• History panel
• Change a user's roles, or deactivate a user
• Invite users and get them signed in
• Roles and permissions