Roles, scopes and responsibility
Understand why access depends on the action, resource and context.
Do not rely on a role's name alone
A role is a set of permissions. The system distinguishes, among other things, reading, editing and managing a resource. Reading a program, editing it, managing an event and managing its lineup can be separate. The name “leader” alone does not describe every possible access right.
The organization owner has separate ownership rights. A broad operational role is not the same as transferring ownership. When creating a role, start with the person's actual responsibilities and grant only the actions needed.
Scope identifies which resources an action applies to
“Own” does not necessarily mean the author of the last change. Responsibility is an explicit assignment. A resource without a team is shared within the organization but is still not public.
| Scope | Practical meaning |
|---|---|
| All | Permitted resources of that type within the organization |
| Own | Resources for which the person is explicitly responsible |
| Teams | Resources permitted by membership and role in that team |
| Assigned events | Events in which the person is part of the lineup |
Prepare a role and check the result
- Open role management if you have the required permission.
- Review existing roles and their detailed previews.
- Create or edit a definition by choosing areas, actions and available scopes.
- Save the definition and, as the owner, assign it to the correct member.
- Check reading and permitted actions with that person on a real resource type.
Additional roles can extend access
Organization permissions and additional team roles are combined. A narrower team role does not remove a broad organization permission. To restrict access, review all permission sources rather than add another similarly named role.
Switching context alone does not change these rules. Team membership also does not automatically grant access to every organization resource. When investigating a problem, check the role, responsibility assignment, resource team and lineup membership.
Deleting a role and revoking access
Deleting a role in use may require a replacement for people and invitations. Check what they will receive before confirming. Access changes apply on subsequent reads; they do not remove a file someone previously downloaded legitimately.
Do not solve a missing button by sharing the owner's account. Correct the role assignment or ask for a specific operation to be performed. Personal accounts and appropriate permissions preserve responsibility for changes.