Menu

Create, edit and assign Roles

  • Roles in GSI2 provide a centralized system for managing user access rights and permissions through role-based access control (RBAC). This guide describes how to create new roles, modify existing ones, and assign them to users.

    Core Concepts

    • Role: Predefined collection of permissions that can be assigned to multiple users
    • Permissions: Specific authorizations to access and operate on system modules
    • Inheritance: Users automatically inherit all permissions from assigned roles
    • Cumulative: A user can have multiple roles; permissions are additive

    Permission Checkbox Color Legend

    In the permissions configuration panel, checkboxes use different colors to indicate the origin of permissions:

    • Orange: Permissions derived from assigned role (cannot be modified at individual level)
    • Yellow: Permissions automatically derived from other permissions (dependencies)
    • Blue: Individual/single assignments set directly

    Part 1: Create a New Role

    Access Role Management

    1. From main menu, navigate to General Tables
    2. Select Roles
    3. The table with existing roles will open

    Role Creation

    1. Click the "+" button at top right
    2. In the creation form, enter:
      • Name: Descriptive role name (e.g., "HR Manager", "CRM Operator", "Attendance Supervisor")
      • Company: Select the company for which the role is valid
    3. Click SAVE to create the base role

    Configure Role Permissions

    1. Find the newly created role in the table
    2. Click the lock icon in the Actions column
    3. The permissions configuration panel will open

    Assign Permissions to Role

    In the permissions panel, configure authorizations by section:

    System Permissions

    • Company Admin: ⚠️ Grants ALL permissions - use with caution
    • Login to Other Companies: Allows access to other companies in the live client
    • Set Permissions: ⚠️ Allows managing other users' permissions

    Module Permissions

    For each module, configure CRUD operations:

    • All: Checkbox under the section title - checking it automatically checks all permissions in the section
    • View (R): View data
    • Create (C): Create new records
    • Update (U): Modify existing records
    • Delete (D): Delete records

    Role Configuration Examples

    "Basic HR Operator" Role:

    • Individuals: View ✓, Create ✓
    • Staff: View ✓
    • Documents: View ✓
    • Other modules: no permissions

    "Attendance Supervisor" Role:

    • Staff: All ✓
    • Individuals: View ✓, Update ✓
    • Approver Rights ✓
    • Notifications: All ✓

    Part 2: Modify an Existing Role

    Modify Role Name

    1. From Roles table, click the role's pencil icon
    2. Modify the name in the text field
    3. Save changes

    Update Role Permissions

    1. Click the role's lock icon
    2. In the permissions panel:
      • Check new boxes to add permissions
      • Uncheck boxes to remove permissions
      • Note yellow highlighted permissions (automatic dependencies from other permissions)
      • Orange permissions derive from the role itself and cannot be modified individually
    3. Click SAVE to apply changes

    ⚠️ Important: Role modifications apply immediately to all users who have that role assigned.

    Part 3: Assign Roles to Users

    Method 1: During User Creation

    1. Navigate to Organization > Individuals
    2. Click Add Individual with Wizard
    3. Step 1: Enter essential data
    4. Step 2: In roles section, select one or more roles from dropdown
    5. Complete creation

    Method 2: On Existing User

    1. From Individuals table, locate the user
    2. Click the lock icon in Actions column
    3. In permissions panel:
      • Roles section at top
      • Select roles from dropdown
      • For multiple assignments, select multiple roles
    4. Save to apply roles

    Verify Assigned Roles

    1. Open user permissions (lock icon)
    2. Active roles are shown in top section
    3. Permissions derived from roles display with orange checkboxes
    4. Additional individual permissions have blue checkboxes
    5. Automatic dependencies appear in yellow

    Advanced Management

    Multiple Role Combination

    When a user has multiple roles:

    • Permissions are additive (union of all permissions)
    • No conflicts: if even one role grants a permission, the user has it
    • Example: Role A (View Documents) + Role B (Create Documents) = User can View + Create

    Override with Individual Permissions

    Beyond roles, you can:

    1. Add specific individual permissions not included in roles
    2. These permissions add to role permissions
    3. Cannot "remove" a permission granted by a role

    Remove Role from User

    1. Open user permissions panel
    2. In roles section, deselect role to remove
    3. Save changes
    4. User immediately loses that role's permissions

    Best Practices

    Role Design

    • Least privilege principle: Grant only necessary permissions
    • Clear naming: Use descriptive names (e.g., "Accountant_ReadOnly" vs "Role1")
    • Granular roles: Better to have many specific roles than few overly broad ones
    • Documentation: Maintain a record of roles and their purpose

    Security

    • Minimize roles with "Company Admin" or "Set Permissions"
    • Periodically review role assignments (quarterly audit)
    • Remove roles when user duties change
    • Don't create "catch-all" roles with too many permissions