Roles, privileges and duties

Three levels, and they compose in one direction only. A PRIVILEGE is the smallest unit — permission to do one thing, like submitting a payment batch. A DUTY ROLE is a bundle of privileges describing a task somebody performs. A JOB ROLE is a bundle of duty roles describing a person's job: Accounts Payable Manager, General Accountant. You assign job roles to people. You almost never assign a privilege directly, and where you find one assigned directly somebody was in a hurry. A JOB ROLE IS A BUNDLE, NOT A PERMISSION, and that is the sentence that stops the commonest mistake in this module. When somebody asks for "the privilege to view invoices", they are asking for something that exists, and granting it on its own usually does nothing visible — because the page they want also needs a duty role they do not hold, and the rows they want…

In this module: Module 2 · Security, roles and what you are allowed to see

1. 1Roles, privileges and duties
2. 2Data security versus function security
3. 3Data access sets and business unit security
4. 4The security diagnostic sequenceFree preview
5. 5Reading the security console
6. 6Security for reporting: the part people miss
7. 7Custom roles: when, and how to survive an update
8. 8Provisioning and role assignment at scale
9. 9What breaks: the three security failures you will meet
10. 10Lab briefing · Diagnosing three access failures