What happens to administrators' case level access when you change user roles?
Case Access
There are two types of case access:
Implicit access: Default access to cases as defined by their user role
- Primary/Owners have implicit access to all cases
- Custom roles have implicit access to cases as defined by their Access Scope (conditional, all or none)
Explicit access:
- Admin is added to case manually under manage access
- Admin is added to case via routing rule
- Roles:
- Subs can only be added via explicit access
- Viewers can only be added via explicit access
- Managers can only be added via explicit access (excluding routing rules)
- Custom roles can be added to cases outside of their access scope via explicit access
- Case Level permissions granted or restricted on specific cases are also considered explicit access
Role Changes:
What happens to access when a role is changed?
-
Explicit Access:
- Explicit access (including specific case level permissions) are retained at role change regardless of new role permissions and access scope
- The admin may also be granted access to additional cases via implicit access depending on the access scope of their new role.
-
Implicit Access:
- Admin will lose access to cases they had implicit access to at role change that do not fall within the implicit access scope of the new role.
What happens to administrators' Feature level access when you change user roles? (Case Management, Charts& Insights, Vera, Settings&Configurational Features, Employees)
When an admin’s role is changed they will lose access to features that are not permitted in their new role.
What happens to a user’s Case access when you change user roles?
Explicit access is retained, implicit access is granted inline with the access scope of the new role.
What happens to a user’s Case level specific permissions when you change user roles?
Their case level permissions will be in line with their new user role unless previously explicitly adjusted on a specific case at the case level under ‘Manage Access’ or overridden on future cases under ‘Manage Access’.
What if I change the access scope for a current role?
Explicit access is retained, implicit access is granted inline with the updated access scope of the role.
How does access scope differ from routing rules?
Access scope as defined by the admins custom role grants implicit access to all new and historical cases that match the conditions set (if not overridden). Access scope is not retained at role change and the users’ access will be inline with the Access scope for the new role unless explicit access or case permissions were granted to the user previously.
Routing rules are not retroactive and are explicit access meaning access is retained at role change though the users individual case permissions may change according to the new role. Another key difference is that Routing Rules: only run on the first version of the case answers (when case is submitted). Role Access Scope: will actively check newer versions of case answers and revoke/grant permissions as needed.
For example:
If we had a routing rule for "ethics" and the answer changed to "culture", admins on that routing rule will still have access to it. On the other hand if we had a role for "ethics" and the answer to changed to "culture", admins with that role would no longer have access to it.