Skip to content

Departments, employments, locations

Identities › Organisation

A person belongs to a department, holds an employment (position) and works at a location. Each of the three can carry business roles, and a person automatically holds the roles of their department, employment and location. When they move, the old ones are withdrawn and the new ones granted.

Departments form a tree. A person also inherits the roles of every department above their own — a role on demoinc reaches everyone in the company.

This is where most standing access is decided: everyone in Sales gets CRM-Users, every Software Engineer gets Developers.

Giving a department a role

  1. Open Identities › Organisation › Departments and the department.
  2. Under Select business role to assign, add the business role.
  3. Save.

Everyone in the department gets the role — and the groups it grants — at once. Employments and locations work the same way, under Organisation › Employments and Organisation › Locations.

An example

In a demo environment, departments grant one or two roles each (see Joiner — what the joiner may do), employments carry 13 role mappings, and locations none — the mechanism is there, it is simply not used in that example.

Inherited roles are not removed by hand

A role a person holds because of their department goes when they leave the department, not when someone removes it from the person. To take it away from everyone, remove it from the department.