Permissions and Roles - Revision history

Mike at 01:36, 30 September 2025

2025-09-30T01:36:15Z

← Older revision		Revision as of 01:36, 30 September 2025
Line 220:		Line 220:
	* '''Money = Admin Territory:''' Financial permissions deliberately restricted to admin roles.		* '''Money = Admin Territory:''' Financial permissions deliberately restricted to admin roles.
	* '''BaseUser:''' Currently has no explicit permissions. Define what they ''can'' do in your application logic.		* '''BaseUser:''' Currently has no explicit permissions. Define what they ''can'' do in your application logic.

			== Role Configuration ==
			Roles are setup on the Users form from the Admin menu.
			[[File:Image RoleConfig.png\|left\|thumb]]

Mike: /* Overview */

2025-09-30T01:32:46Z

Overview

← Older revision		Revision as of 01:32, 30 September 2025
Line 5:		Line 5:
	The system has six user roles, each with different permission levels. Think of it as a video game tier list, but for business operations. 🎮		The system has six user roles, each with different permission levels. Think of it as a video game tier list, but for business operations. 🎮
	----		----

			== Min Zinform 6 Version ==
			The minimum system version for to enable roles is 6.1.13.0

	== Role Hierarchy ==		== Role Hierarchy ==

Mike: /* Quick Reference Matrix */

2025-09-30T01:26:26Z

Quick Reference Matrix

← Older revision		Revision as of 01:26, 30 September 2025
Line 104:		Line 104:

	== Quick Reference Matrix ==		== Quick Reference Matrix ==
			{\| class="wikitable"
			!Permission
			!Super Admin
			!Admin
			!Super User
			!Power User
			!Base User
			!Read Only
			\|-
			\|Organization Details
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|Global Settings
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|Admin Menu
			\|{{yes}}
			\|{{yes}}
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|-
			\|License Management
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|Document Management
			\|{{yes}}
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|User Management
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|Email Settings
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|Banking Settings
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|File/PDF Imports
			\|{{yes}}
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|-
			\|Department Management
			\|{{yes}}
			\|{{yes}}
			\|{{yes}}
			\|{{yes}}
			\|{{no}}
			\|{{no}}
			\|-
			\|Read Only
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{no}}
			\|{{yes}}
			\|}
	----		----

Mike at 01:25, 30 September 2025

2025-09-30T01:25:25Z

← Older revision		Revision as of 01:25, 30 September 2025
Line 99:		Line 99:
	* ✅ IsReadOnly flag enabled		* ✅ IsReadOnly flag enabled

	'''Use Case:''' Auditors, consultants, stakeholders, interns, or anyone who needs to see data but shouldn't change anything.		'''Use Case:''' Auditors, consultants, stakeholders, interns, or anyone who needs to see data but
			shouldn't change anything.
			----

			== Quick Reference Matrix ==
			----

			== Best Practices ==

			# '''Start Restrictive:''' Assign the minimum role needed. You can always promote users later.
			# '''Regular Audits:''' Review user roles quarterly. That intern from 2019 probably doesn't need SuperAdmin anymore.
			# '''Separation of Duties:''' Keep financial and user management permissions limited to trusted admins.
			# '''Document Changes:''' Log role changes, especially escalations to Admin/SuperAdmin.

			----

			== Notes for Developers ==

			* '''Admin vs SuperAdmin:''' Currently identical. Consider restricting <code>CanAccessGlobalSettings</code> and <code>CanUpdateLicense</code> to SuperAdmin only.
			* '''Money = Admin Territory:''' Financial permissions deliberately restricted to admin roles.
			* '''BaseUser:''' Currently has no explicit permissions. Define what they ''can'' do in your application logic.

Mike: Created Page

2025-09-30T01:21:09Z

Created Page

New page

= User Roles & Permissions Guide =

== Overview ==
The system has six user roles, each with different permission levels. Think of it as a video game tier list, but for business operations. 🎮
----

== Role Hierarchy ==

=== 🦸‍♂️ Super Administrator ===
'''"God Mode Activated"'''

Full system access. Can do literally everything.

'''Key Permissions:'''

* All administrative functions
* Global settings configuration
* License management
* User management (create, update)
* Organization details
* Email & banking settings
* File & PDF imports
* Department management
* Document creation & updates

'''Use Case:''' System owner, IT director, or that one person who knows where all the bodies are buried.
----

=== 👑 Administrator ===
'''"Almost Everything Except the Nuclear Codes"'''

Company-level admin with near-complete access. Currently identical to SuperAdmin (you might want to revisit this).

'''Key Permissions:'''

* Same as SuperAdministrator
* Access to all operational and administrative functions

'''Use Case:''' Senior management, operations director, trusted lieutenant.

'''⚠️ Note:''' The comments suggest <code>CanAccessGlobalSettings</code> and <code>CanUpdateLicense</code> should probably be SuperAdmin-only. Worth reviewing.
----

=== 💪 Super User ===
'''"Power User with Training Wheels Off"'''

Can handle most day-to-day operations but can't mess with the company structure or users.

'''Key Permissions:'''

* ✅ Document management (create, update)
* ✅ File & PDF imports
* ✅ Department management
* ✅ Admin menu access
* ❌ Organization settings
* ❌ User management
* ❌ Financial settings
* ❌ License updates

'''Use Case:''' Team lead, operations manager, power user who gets stuff done.
----

=== ⚡ Power User ===
'''"Operational Access, Hold the Danger"'''

More limited than SuperUser. Can manage departments but not much else.

'''Key Permissions:'''

* ✅ Department management
* ✅ Admin menu access
* ❌ Everything else

'''Use Case:''' Department head, mid-level manager, someone who needs organizational visibility but limited editing rights.
----

=== 👤 Base User ===
'''"Standard Issue Employee"'''

Basic operational access. Can use the system but can't change anything structural.

'''Key Permissions:'''

* ❌ All administrative functions disabled
* Can view and use standard features (implied)

'''Use Case:''' Regular employees, data entry staff, most of your workforce.
----

=== 👀 Read-only User ===
'''"Look But Don't Touch"'''

View-only access. The digital equivalent of a museum visitor.

'''Key Permissions:'''

* ❌ Everything is disabled
* ✅ IsReadOnly flag enabled

'''Use Case:''' Auditors, consultants, stakeholders, interns, or anyone who needs to see data but shouldn't change anything.