Default role permission matrix
The tables show the permissions of the three roles that ship with Assist. Permissions can be changed by the administrator in the role editor, so the values may differ for your company. The current permissions of a specific role are always shown in the role editor.
Notation.
- ✔ — allowed.
- ✘ — forbidden or the item is unavailable.
- V — view, C — create, U — update, D — delete.
- All records — all records of the collection are available. Team projects — only records of projects where the person is on the team. Own — only records the person created.
Pages
A page defines whether a menu item is shown and whether the screen opens.
| Page | Admin | Manager | Developer |
|---|---|---|---|
| Workspace (My work) | ✔ | ✔ | ✔ |
| Boards | ✔ | ✔ | ✘ |
| Projects | ✔ | ✔ | ✔ |
| Releases | ✔ | ✔ | ✔ |
| My tracks | ✔ | ✔ | ✔ |
| Employee workload | ✔ | ✘ | ✘ |
| Resources | ✔ | ✘ | ✘ |
| Updates | ✔ | ✔ | ✔ |
| Notifications | ✔ | ✔ | ✔ |
| Profile | ✔ | ✔ | ✔ |
| “Track hours” report | ✔ | ✔ | ✘ |
| “Time allocation” report | ✔ | ✘ | ✘ |
| Workflows | ✔ | ✘ | ✘ |
| Task types | ✔ | ✘ | ✘ |
| Work types | ✔ | ✘ | ✘ |
| Users | ✔ | ✔ | ✘ |
| Custom fields | ✔ | ✘ | ✘ |
| UI labels | ✔ | ✘ | ✘ |
| Roles | ✔ | ✘ | ✘ |
| Audit log | ✔ | ✘ | ✘ |
| Sessions | ✔ | ✘ | ✘ |
The pages “Field tracks”, “Notification transports”, “Notification RACI”, and “API keys” open by the permission for the corresponding collection (see below).
Tabs of a project, release, and task
Tabs open by the permission for the tab. Permissions to create and change inside a tab are set by a separate scope.
| Tab | Admin | Manager | Developer |
|---|---|---|---|
| Project: Scope | V C U D | V C U D | V; C and U — own |
| Project: Boards | V C U D | V C U D | V; C and U — own |
| Project: Overview | V C U D | V C U D | V |
| Project: Releases | V C U D | V C U D | V |
| Project: Calendar plan | V C U D | V C U D | V |
| Project: Calendar | V | ✘ | ✘ |
| Project: Settings | V C U D | V C U D | V |
| Project: Tracks | V C U D | V C U D | V |
| Project: History | V C U D | V C U D | C, U, D — own |
| Release: Scope | V C U D | V C U D | V; C and U — own |
| Release: Board | V C U D | V C U D | V; C and U — own |
| Release: Overview | V C U D | V C U D | V |
| Release: Calendar | V | ✘ | ✘ |
| Release: Tracks | V C U D | V C U D | V |
| Release: History | V C U D | V C U D | V; C, U, D — own |
| Release: Settings | V C U D | V C U D | V |
| Task: Overview | V C U D | V C U D | V |
| Task: Tracks | V C U D | V C U D | V |
| Task: History | V C U D | V C U D | V; C, U, D — own |
The Developer role has no permission for the project and release “Calendar” tab by default. If the “Calendar” tab is missing for you, this is not an error. The administrator can add the permission.
Collections
| Collection | Admin | Manager | Developer |
|---|---|---|---|
| Projects | V C U D, all records | V C U D, all records | V C U D, team projects |
| Releases | V C U D, all records | V C U D, all records | V C U D, team projects |
| Tasks | V C U D, all records | V C U D, all records | V C U D, team projects |
| Tracks (hours) | V C U D, all records | V C U D, all records | V C U D, team projects |
| Tags | V C U D, all | V C U D, all | V C U D, all |
| Boards | V C U D, all | V C U D, all | ✘ |
| Field tracks | V C U D, all | V C U D, all | V, C — all; U, D — own |
| Users | V C U D, all | V U, all | V, all |
| Roles | V C U D | ✘ | ✘ |
| Workflows | V C U D | ✘ | ✘ |
| Task types | V C U D | ✘ | V, U |
| Work types | V C U D | ✘ | V, U |
| Sessions | V C U D | ✘ | ✘ |
| API keys | V C U D, all | ✘ | ✘ |
| Resource plans | V C U D | ✘ | ✘ |
| Task type change (rematch) | U | ✘ | ✘ |
| Global notification RACI | V C U D | ✘ | ✘ |
| Project notification RACI | V C U D | ✘ | ✘ |
| Notification transports | V C U D | ✘ | ✘ |
For the Manager role in the “Users” collection, only these fields are available for change: last name, first name, patronymic, phone, role, and status.
Special permissions
| Permission | Admin | Manager | Developer |
|---|---|---|---|
| Logging time retroactively (older than 7 days) | ✘ | ✘ | ✘ |
| Viewing the “Team” mode on “My work” | ✔ | ✔ | ✘ |
| Creating tasks on “My work” | ✔ | ✔ | ✔ |
The permission to log time retroactively is turned on with a checkbox in the role editor and is off for all three roles by default.
How to use the table
- If you need to understand why an employee lacks some screen, find the screen in the “Pages” table and compare with the employee's role.
- If you need to give an employee a new capability, do not change a system role: copy it with the Duplicate button and change the copy. More: “Roles”.
- Default role priorities: Admin, then Manager (30), then Developer (20). They affect which roles can be assigned to API keys.