Roles

A role bundles individual rights. It is the fine axis beside the coarse security role (see Security roles) and it belongs to the tenant: you decide the names and the rights, not the product.

A right is always written area:verb, for example tenant-user:create. A user holds the rights of all their roles together.

The three roles that ship with a tenant

Every tenant starts with three roles:

Role	Rights	Meant for
admin	system:manage-roles, tenant-user:read, tenant-user:create, tenant-user:deactivate, tenant-user:assign-role, tenant-user:delete	whoever sets the tenant up
manager	tenant-user:read, tenant-user:create	shift lead: see and create users, but not remove them
operator	none	the operator at the machine, who needs no administrative rights

admin is a system role. It cannot be deleted and system:manage-roles cannot be taken from it — otherwise a tenant could lock itself out. manager and operator are ordinary roles; rename, change or remove them as you like.

The rights of user management

Right	Allows
tenant-user:read	see the list, the detail and the tenant’s roles
tenant-user:create	create a user
tenant-user:deactivate	deactivate and reactivate
tenant-user:assign-role	assign and remove roles, set the security role
tenant-user:delete	delete a user
system:manage-roles	reserved for role administration

Each of these is checked on the server, on every single action. A visible button is never the boundary.

Assigning

A user’s role is chosen in Edit, under Role in the application, and saved with Save changes. The dialog holds one role: picking another one replaces the role the user had. The user’s detail lists what they hold under Roles. Taking the admin system role away is refused when no active administrator would be left afterwards.

When user management is read-only (see Directory), assigning and removing are refused as well — even though a role lives entirely in the tenant.

Where new roles come from

Roles and their rights belong to a tenant’s configuration, not to personal data. So today they are created and changed by loading a configuration or a template (chapter Templates). Which means:

• Roles and their rights are replaced.
• Who holds a role survives — the assignment is carried across by the role’s name. If the new configuration no longer carries a role of that name, that person simply holds one role fewer.
• The admin system role is never part of a configuration and no load ever touches it.

A surface of its own, where you create a role by hand and assemble its rights, does not exist yet.