| Role | Description |
|---|---|
| ROLE\_USER | Standard user role. |
| ROLE\_LIMITS | This role is not required, but does serve a special purpose: Atoti Limits creates the KPI (Key Performance Indicator) in the business cube after the limit is in the Approved status. ROLE\_LIMITS is the default KPI owners and readers. KPIs are tagged with owner ROLE\_LIMITS, so they can be distinguished from other KPIs created by other applications. The module deletes the KPIs by ROLE\_LIMITS in the content server during startup, before consuming the initial load limit files.This role also serves as the full-access role in the permission roles, which means that users with this role have all actions enabled in the UI. |
| ROLE\_USERS | Group of ROLE\_USER. This role is used by BPMN in Activiti. In the reference workflow implementation, ROLE\_USERS can initiate the Straight-through and 4-eyes workflows. The value in the activiti:candidateStarterGroups tag is parsed in the module to map to ROLE\_USERS.For example, in the 4-eye BPMN file, USERS can start the workflow process. Atoti Limits checks if the current user is ROLE\_USERS: \ |
| ROLE\_MANAGERS | Group of ROLE\_MANAGER. ROLE\_MANAGER is not used explicitly in the module, but it’s used by BPMN in Activiti. The Activiti security user “MANAGERS” is parsed in the module to map to ROLE\_MANAGERS: \ |
| ROLE\_ADMIN | Can access the RESTful endpoints and issue the web service against the Atoti Server instances. In the reference workflow implementation, ROLE\_ADMIN can trigger the limit evaluation RESTful endpoint. |
| ROLE\_ACTIVITI\_USER | Can access the Activiti queries. |
| ROLE\_ACTIVITI\_ADMIN | Can update the process definition in Activiti at runtime. Currently, the reference workflow implementation doesn’t provide this functionality. |
| Role | Description |
|---|---|
| ROLE\_READ\_ONLY | Read-only access to the limits in the UI. A user with this role will have all actions disabled. This role takes precedence over all other permission roles, so all actions are disabled even if the user has other permission roles. |
| ROLE\_LIMITS (full access) | Full access to all actions in the UI. A user with this role is equivalent to a user with all individual permissions roles below. The read-only role |
| ROLE\_CREATE\_STRUCTURE | Can create a limit structure. Users that don’t have this role, or ROLE\_LIMITS, will have the Create Limit Structure and Upload limit structures buttons disabled in the Inventory. |
| ROLE\_UPDATE\_STRUCTURE | Can update an existing limit structure. Users that don’t have this role, or ROLE\_LIMITS, will have the Limit Structure form elements in the Limits viewer disabled. |
| ROLE\_DELETE\_STRUCTURE | Can delete an existing limit structure. Users that don’t have this role, or ROLE\_LIMITS, will have the Delete button disabled in the Limit Structure panel of the Limits viewer. |
| ROLE\_EVALUATE\_STRUCTURE | Can evaluate a limit structure. Users that don’t have this role, or ROLE\_LIMITS, will have the Evaluate button disabled in the Inventory. |
| ROLE\_CREATE\_STRUCTURE\_LIMIT | Can create a new limit on the limit structures that are viewable. Users that don’t have this role, ROLE\_CREATE\_ANY\_LIMIT, or ROLE\_LIMITS will have the Add Limit button disabled in the Limits viewer. |
| ROLE\_CREATE\_ANY\_LIMIT | Can create a new limit on any limit structure. Users that don’t have this role, or ROLE\_LIMITS, will have the Upload limits button disabled in the Inventory. |
| ROLE\_UPDATE\_LIMIT | Can update an existing limit. Users that don’t have this role, or ROLE\_LIMITS, will have the Edit limit icon disabled for each limit in the Limits viewer. |
| ROLE\_DELETE\_LIMIT | Can delete an existing limit. Users that don’t have this role, or ROLE\_LIMITS, will have the Delete limit icon disabled for each limit in the Limits viewer, as well as the Delete button above the Limits table. |
| ROLE\_CREATE\_TEMP\_LIMIT | Can create a temporary limit. Users that don’t have this role, or ROLE\_LIMITS, will have the Create temporary limit button disabled for each limit in the Limits viewer. |
| ROLE\_COPY\_LIMIT | Can copy an existing limit. Users that don’t have this role, or ROLE\_LIMITS, will have the Copy limit icon disabled for each limit in the Limits viewer. |
| ROLE\_DOWNLOAD\_LIMIT | Can download limits and structures as CSV files. Users that don’t have this role, or ROLE\_LIMITS, will have the Download icon disabled in the Inventory. |
| ROLE\_APPROVE\_REJECT\_LIMIT\* | Can approve or reject a limit. Users that don’t have this role, or ROLE\_LIMITS, will have the Approve and Reject buttons hidden in the Limit Structure panel of the Limits viewer. |
| ROLE\_PROCESS\_INCIDENT\* | Can review breaches and comment on warnings. Users that don’t have this role, or ROLE\_LIMITS, will have the Review and Comment buttons hidden, as well as the Process icon disabled for each incident in the Status. |
| Default user | Role | Create/update/delete | Upload file | Approve limit change/deletion |
|---|---|---|---|---|
| user1/user1 | ROLE\_USER ROLE\_USERS ROLE\_ACTIVITI\_USER ROLE\_CS\_ROOT ROLE\_LIMITS | |||
| user2/user2 | ROLE\_USER ROLE\_USERS ROLE\_ACTIVITI\_USER ROLE\_CS\_ROOT ROLE\_LIMITS | |||
| manager1/manager1 | ROLE\_USER ROLE\_MANAGERS ROLE\_ACTIVITI\_USER ROLE\_CS\_ROOT ROLE\_EVALUATE\_STRUCTURE ROLE\_APPROVE\_REJECT\_LIMIT ROLE\_PROCESS\_INCIDENT | |||
| manager2/manager2 | ROLE\_USER ROLE\_MANAGERS ROLE\_ACTIVITI\_USER ROLE\_EVALUATE\_STRUCTURE ROLE\_APPROVE\_REJECT\_LIMIT ROLE\_PROCESS\_INCIDENT | |||
| admin/admin | ROLE\_ADMIN ROLE\_CS\_ROOT ROLE\_USERS ROLE\_MANAGERS ROLE\_USER ROLE\_ACTIVITI\_USER ROLE\_ACTIVITI\_ADMIN ROLE\_LIMITS | |||
| restrictedUser/restrictedUser | ROLE\_USERS ROLE\_ACTIVITI\_USER ROLE\_CS\_ROOT ROLE\_READ\_ONLY |