Permissions & groups
Uslimato controls access through groups and named permissions, not a single role per person. Rights therefore never hang off an account directly but always off a group — someone in several groups holds the sum of all their rights. It is managed under Settings › Permissions; the page is only visible to administration.
#The seven permissions
| Permission | What it allows |
|---|---|
admin | Full access — includes all the others |
catalog:write | Create, change and delete manufacturers, models and device types |
assets:write | Create, change and delete assets |
assets:use | Use assets — start processes, assign, set location |
processes:manage | Create, change and delete process definitions |
processes:use | Start processes and complete steps |
users:manage | Create and change users, and manage groups |
The difference between :write and :use is the difference between *setting up* and *applying*. A stockroom team needs assets:use to hand devices out — but not assets:write to change master data.
#System groups
Creating a tenant creates five groups automatically. Their rights are fixed and cannot be changed; you decide the members freely.
| Group | Rights |
|---|---|
| Admin | admin |
| Asset Maintainer | catalog:write, assets:write |
| Service Member | assets:use, processes:use |
| Process Manager | processes:manage, processes:use |
| User Manager | users:manage |
System groups can neither be changed nor deleted. If you need a different combination, create a group of your own.
#Creating your own groups
- Open Settings › Permissions
- Click Create group
- Give it a name that says something, e.g. "Stockroom team"
- Tick the permissions you want
- Save
The group appears in the overview straight away and can take members.
#Managing members
- Expand the group in the list — the current members appear
- Pick a person via the search field
- Click Add member
- To remove, click the × next to the name
#Common questions
#What applies with several groups?
Effective rights are the union of all groups. Someone in *Service Member* and *Process Manager* holds assets:use, processes:use and processes:manage. No right takes another one away — permissions only add up.
#How do I narrow someone down again?
By removing them from the group that carries the right. Withdrawing a single permission while the group still carries it is not provided for — deliberately, because exactly those exceptions are what make permission systems impossible to audit.
#How does this relate to roles?
"Role" is, day to day, often just what someone ends up with through their groups. How tenants, roles and visibility fit together as a whole is covered in Multi-tenancy & roles.