A button is disabled, or was refused when pressed
You can see the screen but can't perform an action. Reading and changing are separate keys.
For: Tenant administrator, Account administrator, Platform administrator, Builder, Operator
What happened
You can open a screen and you see the list. But the action's button is disabled, or in its place it says “You don't have access to this surface: scope.write (tenant)”. Sometimes, when you press the button, a line such as NOT_PERMITTED: scope.write at tenant/…: default_deny_no_matching_rule appears.
Why it happens
In inlorus seeing and changing are separate permissions: seeing a list needs read, adding to it or changing it needs write, and opening it for others to use needs publish. You may have been given the right to see but not the right to act. A refusal after pressing a button usually means your permission changed after the screen opened, or the job was requested in another scope.
What inlorus does
- It shows you the reading part of the screen and states the missing key in the action part.
- It re-evaluates the permission when the button is pressed; it does not trust the state at the moment the screen opened.
- It shows the reason for the refusal as it is, with the code and the missing key.
What you do
- Read the key and scope in the refusal:
scope.write at tenant/…means you don't holdscope.writein this tenant. - Refresh the page. If your permission was just granted, the button now works.
- If it is still refused, ask the scope's admin for a role that carries that key.
How to keep it from happening again
- When dividing up work, keep read and write permissions apart on purpose; don't give someone the right to change something they only need to watch.