Roles and action permissions: separating visibility from authority

A role groups permissions for a defined responsibility. Viewing a record, creating it, changing it, deleting it and voiding it are different powers. Someone who needs information does not necessarily need authority to alter the underlying transaction.

This separation supports clear work ownership. A purchasing clerk may prepare a document while a different responsibility reviews an exception. The exact arrangement belongs to the organisation; a role name alone does not establish that separation.

Roles in DNA

DNA's role editor represents permissions for exposed masters and transactions, including basic actions and additional special permissions. The role has a name, description and active setting. Saving checks the user's authority and validates a nonempty, unique role name before submitting the permission map.

The reviewed editor builds its permission structure from the frontend registry. It also preserves report and dashboard resource permissions in the saved map. The saved configuration should be examined by its actual permissions, not only by a label such as “Manager.”

Special permission requires a reason

An exception permission can materially change a workflow. Examples elsewhere in DNA include modifying approved documents or bypassing a particular control. Such authority should correspond to a real responsibility and a defined review process.

Granting an exception to overcome one confusing error can create broader consequences. First identify whether the problem is missing master data, an incorrect document, a legitimate control or a genuine access requirement.

Verify the intended behaviour

A role configuration is not a substitute for checking the relevant workflow under that role. Frontend restrictions show how the interface controls access; server enforcement and the deployed environment need their own verification.

A useful access review records the responsibility, permitted actions and justified exceptions. Revisit it when business duties change, rather than allowing privileges to accumulate indefinitely.