The security diagnostic sequence

"This person cannot see that." Six checks, in order. Each rules out one layer, and doing them in this order means you never grant something to find out whether it helps. One. Is the role actually assigned to that user? Not requested, not in a provisioning rule — assigned, visible on their record today. Two. Has the role taken effect? Role assignment is not always instantaneous, and a user who has not signed out and back in may be carrying yesterday's session. Three. Does the role carry the privilege the page needs? This is where a copied role that was forked before a quarterly update quietly falls behind. Four. Does the page open at all? If yes, function security is satisfied and the rest is data. If no, stop here — the answer is in the first three. Five. Does the user have business unit or organization access to the…

In this module: Module 2 · Security, roles and what you are allowed to see

1. 1Roles, privileges and duties
2. 2Data security versus function security
3. 3Data access sets and business unit security
4. 4The security diagnostic sequenceFree preview
5. 5Reading the security console
6. 6Security for reporting: the part people miss
7. 7Custom roles: when, and how to survive an update
8. 8Provisioning and role assignment at scale
9. 9What breaks: the three security failures you will meet
10. 10Lab briefing · Diagnosing three access failures