🤷♂️ How Are User Permissions and Restrictions defined?
A user’s ability to perform actions on objects in the application is controlled through three complementary mechanisms.
These tools help administrators manage user access and preserve confidentiality, or prevent interference between teams.
Permissions and restrictions apply to all Aletiq objects: Documents, Parts, Products, and Workflows.
They are configured using:
User Roles
Access Scope
Access Rules
👨🔧 A user can only act on an Aletiq object if they meet the conditions of all three access control mechanisms.
👮♀️ User Role
The role defines the type of actions a user is allowed to perform in the application — across all object types.
A user can never perform actions beyond their role:
Shared computer: can view objects and leave comments
Viewer: can also be assigned to workflow tasks
Manager: can also create and edit application objects
Admin: can also access the Admin panel to manage users, properties, views, and integrations
A user’s role is defined when their account is created and can be updated by an administrator via the User Management Portal.
💡 For more information: Create and manage users
🏭 Access Scope
The access scope defines the maximum group of users who can access a specific object in the application.
A user cannot view an object if they are not included in its scope.
An object’s visibility may be limited to:
The owner only
Users from one or more sites
All users in the organization
The distribution scope is a property of each object and object template.
By default, it is set to the site of the creator at the time of object creation, and can be modified via the Share menu.
💡 For more information on site creation: Manage a site
🚧 Access Rules and Permission Levels
The Access Rules system allows defining user permissions based on object properties.
Permissions are divided into four levels:
Visualize without downloads: the document can be viewed in the application but cannot be downloaded to the user’s machine
Visualize: the document can be opened in the browser and downloaded, but not modified
Modify: the document can be opened and modified, but draft revisions cannot be validated
Full access: all permissions granted
Access rules assign a level of authorization to a group of users, over a group of objects, based on custom properties.
Access rules are configured by administrators.
💡 For more information: Set up and manage access rules
ℹ️ To verify which rules apply to a given object, check the Share tab.
📑 Summary...
A user can access an object in the application only if:
✅ Their user role allows it
✅ They are within the object’s access scope
✅ An applicable access rule grants them the required level of permission