Roles and Rights

As a quick introduction, here is a hierarchical view of the different Roles. Click on the different levels to see subjacent roles:

In the following table, you find an overview over the most important roles and rights, to offer a simple glance of the the most important roles. For more advanced needs, you can further divide the roles of Expert, Viewer and Admin into more fine-grained roles, details of which are listed in the second table at the end of the page.

The roles in capital letters are used for user rights synchronisation via LDAP, see  LDAP (Active Directory) Systemparameter, Parameter LDAP_SECURITY_GROUPS_MAPPING.

Most important roles

Further roles, fine-grained according to functional scope:

*LDAP synchronization not yet implemented

Footnotes and details:

¹⁾ if delegated including Submit
²⁾ if action type allows creation by Enduser
³⁾ only if "May Edit" checkbox is selected for Action Owner
⁴⁾ only if "May Edit" checkbox is selected for Action Owner & Enduser = Primary Action Owner
⁵⁾ only for Controls
⁶⁾ only for Actions
⁸⁾ via Switch User
⁹⁾ Scopes are: OrgUnit
¹⁰⁾ Relevant for «central» documents – for attachments (e.g. of Tasks / Actions, ...) this right is not 
¹¹⁾ with own OrgUnit
¹²⁾ checked are OrgUnit AND Incident Type 
¹³⁾ only if the Enduser receives "additional read right" in a specific Report

Scopes determine the reach of the role

Depending on the role it is possible to limit the reach of the role via scopes.
This way, user rights can be given for a certain part in the organization in accordance with the "Need-to-know" principle. 

Following is an overview of the available scopes. Hint: not all scopes are relevant for all roles.

Additional info

There are some specific points that need to be mentioned:

• A User Admin cannot change its own In Produktion kann ein Administrator seine eigenen Rechte nicht ändern, in den Test-Umgebungen hingegen schon. 
• Some roles / scopes are only relevant for specific modules
• In some places there are additional settings that restrict user rights further, e.g.:
  • "Closed user group" in OrgUnits
  • "Always visible for own OrgUnit" im Document Type (DMS)