Roles & rights

Under Management → Roles and rights you manage access and permissions within a collection. Roles and rights let administrators control which users can access modules, objects, and variable values on the platform. Access to this page requires the User management module.

From here you create, edit, and delete roles and user groups. Roles, rights, and user groups are collection-specific: each collection has its own separate configuration.

Roles

A role defines a set of permissions within a collection, made up of module access, object access, and variable values. Roles determine what a user is allowed to read, save, or delete on the platform.

Users can be assigned a role directly. This is mainly used for unique or specific permission setups.

User groups

A user group is used to assign multiple roles to multiple users at once. It has a one-to-many relation with both users and roles: one group can contain multiple users, and multiple roles. A group can also hold variable values.

Using user groups is the most common way to assign permissions, especially when several users need the same access level.

Default user groups

Every collection gets two default user groups: Collection admins and Viewer users. These can be deleted if they aren’t needed, but be careful when removing Collection admins.

Rights

Rights determine what users are allowed to do in a module, assigned per module:

Right	Description
Read	View or access the module.
Save	Create or update data or configuration in the module.
Delete	Delete data or configuration in the module.

Module rights

Module rights control access to specific modules, each configurable with Read, Save, and Delete. Modules include:

Dashboard designer, Dashboard mapping, Dashboard flows, Forms designer, Form mapping, Data connections, Datahub, Dataclip designer, Agent designer, Display texts, Notifications, Database tags, Form web links, Document services, Advanced configuration, and Viewer.

Object rights

Object rights control access to specific objects within a collection, such as dashboards, dataclips, form definitions, and dataflows. This lets you grant access to specific items instead of an entire module: for example, access to the Forms module but only to certain form definitions.

Variables

Roles and user groups can hold variable values: reusable values that can be used for filtering, configuration, dashboards, forms, navigation flows, and integrations.

When the same variable is set at multiple levels, the value is resolved using this precedence, from highest to lowest:

1. Personal value on the user
2. Authorization structure
3. Authorization group
4. Direct role assignment

Typical use cases include external system IDs, employee types, conditional form visibility, button access, dashboard or form filtering, and other user-specific configuration values.

Variables are referenced as {@variableName}, for example {@employeeType}.

Assigning roles

Method	Description
User group assignment	The most common method: add users to a group that holds one or more roles.
Direct role assignment	For unique setups where a user needs a role outside of any group.

Prefer user groups when multiple users need the same permissions, and reserve direct role assignment for specific exceptions.

Tips

• Use user groups for common permission setups, and direct role assignment only for unique or user-specific access.
• Keep role names clear and descriptive.
• Configure module rights first, then refine access with object rights where needed.
• Use variable values when access or behavior depends on user-specific context.
• Review roles and user groups regularly to prevent outdated permissions.
• Be careful when deleting default user groups, especially Collection admins.