...
Canopy defines a number of global roles to make permission management easier with the system. The system defined roles are as follows:
| Role name | Default Permissions | Description |
|---|---|---|
| Administrators |
| This is the global administrator. This user can perform any action on the system and access any object - i.e. no restrictions. However, the admins activities are logged. |
| Technical Managers |
| A Technical Manager is a user role that is one step down from an administrator. They are able to perform practically all operations on the system, with the exception of administration level actions (e.g. user management). |
| Senior Analysts |
| A Senior Analyst is a trusted user within the system who can perform key operations, including KB management and project creation. By default, these users can also view (readonly) companies and methodologies. |
| Analysts |
| An Analyst has a reduced set of permissions and must be explicitly granted access to a company, opportunity or project before they can work on anything. They are able to perform some operations, such as |
| Sales Managers |
| A special admin-like user for managing companies, and opportunities and their related templates. However, this user has limited access to projects and other technical content. |
| Account Managers |
| A user for managing companies and opportunities. No default access to projects is assigned. |
| Peer Reviewer | Special permissions assigned on a short life time (as needed) for modifying a specific report and commenting on it. | These permissions are assigned based on the workflow engine. |
| Quality Assurer | Special permissions assigned on a short life time (as needed) for modifying a specific report and commenting on it. | These permissions are assigned based on the workflow engine. |
| Info |
|---|
A number of additional roles will be included in the next iteration of Canopy, including: low privilege user role and the KB admin role. |
...
The specific instances of these roles on their corresponding objects are explained next.
Company
| Role | Permissions | Description |
|---|---|---|
| readonly |
| View only access to a company. |
| admin |
| Manage the content and access control of an opportunity. |
Opportunity
| Role | Permissions | Description |
|---|---|---|
| readonly |
| View only access to an opportunity. |
| write |
| Manage content associated with an opportunity. However, the structure of the opportunity cannot be changed (e.g. add more phases). |
| admin |
| Manage the structure, content and access control of an opportunity. |
Project
| Role | Permissions | Description |
|---|---|---|
| readonly |
| This is a readonly role. No content editing can be performed by a user with this role. |
| write |
| Manage content associated with an opportunity. However, the structure of the opportunity cannot be changed (e.g. add more phases). |
| admin |
| Manage the structure, content and access control of an opportunity. |
Granular Permission Descriptions
The following table lists and explains the granular permissions available in Canopy:
TODO...
...
| Info |
|---|
Adding further granular permissions is a relatively simple task, although it is something that CheckSec controls at the moment. |