Business roles¶
Access › Business roles
A business role is a bundle of access with a business meaning — Sales Rep, IT Administrator, Birthright AD Role. A role grants target resources: account definitions (and with them accounts) and groups. People get roles in four ways:
| How | Where |
|---|---|
| By rule — the role's assignment rule matches them | The role's Dynamic Assignment tab |
| By inheritance — from their department, employment or location | Departments, employments, locations |
| By request — ordered in the shop and approved | My work › Request access |
| Directly — assigned to the person by an administrator | The person |
A person's page shows, under Access, every role they hold and why.
What a role grants¶
On the role's Business Role tab, Select target resources to assign chooses what the role grants: account definitions and groups.
Entitlements apply to decides which of a person's accounts the role's groups go on. Leave it empty unless the role is about a specific kind of account — for example a role granting administrative groups should name the administrative account definition. Empty means the primary definition of that target system. See Joiner — which account a group goes on.
Assignment rules¶
On the Dynamic Assignment tab, an Assignment Rule makes the role dynamic: it is checked for a person whenever they are saved, and the role is granted when the rule is true and withdrawn when it becomes false.
Rules are expressions about the person:
| Rule | Who gets the role |
|---|---|
true |
Everyone |
department != null and department.name == 'IT' |
People in the IT department |
position != null and position.name == 'Software Engineer' |
People in that employment |
location != null and location.name == 'Sofia' |
People at that location |
Rules may read the person's properties and compare them. For safety they cannot call methods or
reach into the system: method calls such as name(), and T(LocalDate).now(), are not available. Guard against
missing values with != null, as above — a rule that fails to evaluate grants nothing.
Check a rule before relying on it
The field suggests property names as you type. After saving, Recalculate Immediately re-evaluates the rule for everyone; the Assigned Identities tab then shows who holds the role.
Who holds a role¶
- Organizational Assignments — the departments, employments, locations and shop items that grant the role.
- Assigned Identities — everyone who holds it, and how they got it.