Roles

A role is a set of restrictions and tags. Each restriction blocks the actions it names on the records its condition matches. Everyone who holds the role is held to it. A person's admin rights say what they may do; their roles narrow which records they may do it on.

A role open in the Roles window, with its rights and restrictions

The Roles window

Admin › Users › ⋯ More › Roles opens the window: every role on the left, the selected role on the right. A row shows how many restrictions the role has.

• Filter by name searches the roles. Filters narrows by whose roles they are (Mine, Not mine, Others), by the Model and Field a restriction covers, by the actions it is Restricted From, and shows deleted roles.
• Add role starts a new role. ⋯ More holds Import roles and the exports.
• Tick roles to change them together, print, delete or restore them.

A role's form

A role has a Name, an Owner, Tags and its Restrictions. Save writes the role.

People who hold the role arm its tags. Every record they create then carries them. See My profile.

You give a person a role from their window in Users.

Restrictions, as sentences

Restrictions reads in plain language:

Members of the Field Technician role can do everything except: • Delete Work Order records where name is "freckle". • Create & Edit Work Order records where status is any of "completed", "in-progress".

Each line is one restriction. A line that blocks nothing yet reads Blocks nothing yet, because it has no action chosen.

Press a line to edit it:

• Model: the kind of record, such as Work Order, Site or Feature. Feature also covers assets.
• Field: the field to test. Pick one of the model's fields or type a property name.
• Comparison: is, is not, is greater than, is at least, is less than, is at most, contains, is any of, is none of, or is between.
• Value: one value, a list for is any of and is none of, or two bounds for is between.
• Blocked actions: Create, Read, Edit and Delete.

Add restriction adds a line. Remove deletes one.

Limiting a role to some records

To give a group authority over some records and not others:

1. Tag those records, for example north.
2. Give the group's role a restriction on the tags field, with the comparison is not and the value north, blocking the actions you want kept to those records.

The line then reads the other way round: So members can read only Feature records where tags is north.

Each role a person holds narrows further. Two such roles leave only the records carrying both tags. To cover two areas with one role, use is none of with both tags: So members can read only Feature records where tags is one of north, east.