Creating roles
Roles must be created by the Administrator before they can be assigned. When creating roles there are certain rules to keep in mind.
Creation rules:
- Create the minimum number of roles necessary. Because permissions cannot be revoked, a large number of roles, when assigned, will quickly make it impossible to say which permissions a user has for a certain object. The smallest set of roles possible will reduce confusion.
- Do not assign global roles unless you do not want to use authorization. Granting permissions on this level means that they cannot be revoked on lower levels. Grant enough permissions on the global level and roles on lower levels will as a result be rendered meaningless.
- Use the Project Manager role to delegate managing authorization on project level. Configuring authorization is one of the permissions that are part of the role Project Manager. The administrator can delegate the management of authorization on project level by just appointing a project manager per project and let him take care of the details. The User Authorization report will provide an overview of all roles a user has in all projects for the administrator.
Refer to Predefined roles for the complete list of roles. For more information refer also to Authorization and roles and The rules for roles.