Users and permissions
Three kinds of identity
| Identity | Is | Sees |
|---|---|---|
| User | Someone who works here | What their roles allow, in the organizations they belong to |
| Portal access | A customer's contact | Their own documents and tickets, nothing else |
| Anonymous | A visitor | Published public content |
A customer is never a user of your organization
Portal access is a separate axis on purpose. Making a customer a member with a narrow role would put them one misconfigured permission away from your data; keeping them a different kind of identity means the mistake cannot be made.
Roles
A role is a named set of permissions. Users hold roles per organization, so the same person can administer one firm and have no access to another.
Permissions are granular and named after what they let you do — publish content, administer taxonomy, manage GDPR, see costs. Assign roles, not individual permissions, or a year from now nobody will know why one account can do something.
Organizations and membership
Membership is what puts an organization in somebody's toolbar. Without it, the firm does not exist as far as that account is concerned.
The toolbar follows the same rule. A member of one firm is always inside it: the bar shows the firm's name, offers no switch and no "all organizations" — there is nothing else to choose and no outside to stand in. A member of several firms gets a switch between exactly those. Only the platform owner (a superuser) may stand outside every firm, which is how site-wide defaults are edited.
The same rule bounds a firm's administrator. The permission to administer organizations opens the Organizations screen, the organization profile and the assistant's organization tools — but what those doors show is decided by membership: a superuser sees every firm, anybody else sees the firms they belong to, and another firm's profile answers exactly like a firm that does not exist. Whoever creates a firm becomes its member at once, so they can open what they created.
Administrator is the platform's role
The shipped Administrator group carries platform-wide screens — system, modules, translations, views, menus, branding. Give a firm's own admin a narrower role built from the agenda permissions she needs; membership keeps her inside her firm, but a platform screen has no firm to keep her in.
Signing in
Sign-in is rate-limited, and the login page carries the organization's own branding rather than the platform's.
What to check when someone cannot see something
- Which organization is open in their toolbar — this is the answer most of the time.
- Whether they are a member of the organization at all.
- Whether their role carries the permission.
- Whether the content is published and carries its publication stamp.