Roles
The screen where you create a role at the platform or at an account, and change which permission keys a platform role carries. Before you save a change to a role's keys, it shows who will gain and lose what.
Where it works
At the platform, the screen changes the keys of the platform's roles (the five archetypes and the roles the platform created) and creates new platform roles. A platform role's keys are the same in every scope; a change made here affects everyone who holds the role, wherever they hold it. The page is Roles in the menu and follows the scope switcher: at an account or a tenant the same page shows who holds which role there (see that scope's help). At the platform, every platform role is in the list on the left with how many permissions it carries; choose one to change it on the right. With no role chosen, the right side holds Create a role.
Creating a role
- With no role chosen in the list (at an account: below the assignments), under Create a role, type its Name, for example
Education coordinator. - Leave Key empty to make it from the name (
education_coordinator), or type your own: lower-case letters, digits and underscores, starting with a letter. The key never changes, and it must not be used by any other role, at any scope. - Choose its Permissions from the permission keys. The scope is on the assignment, not the key.
- Press Create role at …. The message names the key and where the role can now be assigned.
A platform role can be assigned at the platform, in any account and in any tenant, and a capability's Contents can carry it (a package role). An account's role can be assigned in that account and its tenants, never in another account's. Both appear in the Role list of the account's and the tenant's Roles screens, beside the archetypes. Nothing is written when the role could not be served as it stands (for example a key used elsewhere, or no permission chosen); the reason is shown.
Changing a role
- Choose the role in the list on the left; the number of permissions it carries is shown beside it. The address keeps the choice (
?open=<key>). - Under Permissions, tick or untick keys. Only defined permission keys are offered. The scope lives on the assignment, not on the key.
- Press What will change?. A before/after comparison, Permissions gained, Permissions lost and Affected subjects (person @ scope type) appear.
- If you like, enter a person's ID and a permission key in the impact panel and press Which decisions flip?: the same request is decided twice, as it stands today and after the change, and whether it flips is shown with the reasons.
- Press Apply. You are told how many grants were written.
Keep in mind Apply becomes available only after the preview; if you change even a single box after the preview, you need to press What will change? again.
Who can do what
| Task | Permission key needed (in the platform scope) |
|---|---|
| See the screen, preview, try the impact | role.read |
| Apply | role.write |
| Create a role | role.write at the platform or at the account the console is in |
Tip A reviewer holding role.read can see the change and its impact in full; only the Apply button is replaced by a missing-permission notice.