Edit role
Change a role's name, description, active flag and permissions, see who holds it, and open its History.
Edit role
This page shows one role: its name, description, whether it is active, the permission matrix and the people who hold it. Use it to tailor a default role to your organization, adjust a custom role, or simply see what a role allows. The page is titled with the role's name.
Where to find it
On Roles & Permissions, click the role's name or the pencil (Edit) or eye (View) icon on its row. Cloning a role also lands here, on the new copy.
The page needs the View permission on Roles & Permissions (otherwise "No access" and "You do not have permission to view roles. Ask your administrator."). Changing anything needs the Edit permission on Roles & Permissions; without it every field is disabled, Select all, Clear and Save role are hidden and the link at the bottom reads Back to roles. The Administrator role is read-only for everyone.
If the role cannot be loaded (for example it was deleted), the page shows the error ("That item could not be found.") with a Back to roles link.
What you see
The header is the role's name, with a line that depends on the kind of role:
- Administrator: "Administrator always holds every permission and is kept in sync by the system."
- another default role: "A default role: tailor its permissions to your organization. It can be deactivated but not deleted."
- a custom role: "Name the role and tick what it may do in each module."
On the right of the header: the History button and the badges Default role, Locked (Administrator), Inactive and Default for invites, as they apply.
The first card holds Role name (required, 2 to 100 characters), Description ("Optional", up to 255 characters) and, for every role but the Administrator, the toggle Role active: "Inactive roles grant nothing and cannot be assigned, but keep their permissions for later."
The Permissions card shows "N of M selected", Select all and Clear, and the matrix of modules and actions described in New role: one row per module with All, View, Create, Edit, Delete and the extra actions (Approve, Issue, Post, "publish", "send"), grouped by area with a group All box and a "have/total" count.
The Members card lists who holds the role: "N users", then each person's email with their status badge (Active, Invited, Invitation expired or Inactive) and "project-scoped" when the role was given for one project. It reads "Nobody holds this role yet." when empty and "Showing the first 50." when there are more. Under the list: "Assign or remove this role per user from Users." The card is shown only if you have the View permission on Users.
At the bottom: Save role and Cancel when you can edit, otherwise Back to roles.
What you can do
Role active
Retires or restores the role. Off means the role grants nothing and cannot be given to anyone; its permissions and members are kept. The change is saved with Save role.
- Who: anyone with the Edit permission on Roles & Permissions. Not shown on the Administrator.
Select all
Ticks every permission in the matrix.
- Who: anyone with the Edit permission on Roles & Permissions, on any role but the Administrator.
Clear
Unticks every permission.
- Who: as above.
Save role
Saves the name, description, active flag and the ticked permissions. The ticked set replaces the old one, so unticked permissions are removed.
- Who: anyone with the Edit permission on Roles & Permissions. Never on the Administrator, whose page is read-only for everyone.
- Blocks: a name already used by another role: "A role with this name already exists." under the name field.
- What happens next: "Role "<name>" updated." and you return to Roles & Permissions. Holders get the new permissions when their session is next renewed (within about 15 minutes), or at once if they sign out and in.
Cancel / Back to roles
Returns to Roles & Permissions without saving.
History
Opens the History panel for the role: who created it, renamed it, deactivated it, and every permission added or removed, newest first. Lines of the role (its permissions) are included.
- Who: anyone with the View permission on Roles & Permissions or on Audit Trail.
Users
The Users link in the Members card opens Users, where you give or change the role per person with Edit role & access.
- Who: anyone with the View permission on Users (the card is hidden otherwise).
Statuses
| Badge | Meaning |
|---|---|
| Locked | The Administrator: every permission, always; cannot be renamed, deactivated or deleted. |
| Default role | A role that came with your organization. Can be tailored and deactivated, not deleted. |
| Inactive | Retired with Role active off (or Deactivate on the list). Grants nothing until reactivated. |
| Default for invites | Would be pre-ticked on the invite form. Nothing sets this today, so it does not appear in practice. |
Things to know
- The Administrator is kept in step by the system. As new modules arrive, the Administrator gets their permissions automatically. That is why it cannot be edited: there must always be one role that can do everything, so an organization can never lock itself out. To have an administrator with fewer rights, clone the role and trim the copy.
- Members are managed from Users, not here. The Members card is read-only; to add or remove the role from someone, open their row on Users.
- Removing a permission is not immediate for signed-in users. They keep it until their session is renewed, within about 15 minutes.
- Tailoring a default role may not survive a reseed. If whoever maintains the server reseeds the default lookups and roles, any default permission you removed from a Default role is granted again. A cloned custom role keeps your changes.
- Deactivating leaves members attached. They lose the role's permissions but still show in Members. The role drops out of the Role list on Edit role & access, so move each holder to another role from Users.
- "project-scoped" members hold the role everywhere. Project scoping is recorded but not yet restricted, so a project-scoped role grants its permissions across the organization.
- View is usually needed alongside the others. A page needs the View permission on its module to load, so tick View whenever you tick another action on a module.
Related
Related
- Roles & PermissionsScreen
The list of your organization's roles: open one, create or clone a role, deactivate or reactivate it, and delete custom roles nobody holds.
- New roleScreen
Name a new role, describe it and tick what it may do in each module, then create it so it can be given to users.
- UsersScreen
The people in your organization: invite new users, change their role, deactivate or reactivate them, reset a lost two-factor authentication, and resend or revoke pending invitations.
- Audit logScreen
The organization-wide change log: every create, change and delete, every sign-in (including refused ones), sign-out and downloaded file, with who did it, when, from where and what changed.
- History panelScreen
See who changed a record, what they changed and when, including the record's lines, newest first, and jump to the full audit log.
- Roles and permissionsConcept
What a permission is (a module plus an action), how roles bundle permissions, the twelve default roles and what each is meant for, the one-role-per-user rule, and when a change reaches a signed-in user.
- Create, tailor or retire a roleHow-to
Make a new role from scratch or as a copy of an existing one, tick the permissions it grants per module, tailor a default role to your organization, retire a role you no longer need, and give the role to users.