How your permission is computed
In the dynamic permission model nobody has a fixed role. Each time you open an inventory (location, system, equipment) or do something on it, kommuns computes your permission there at that moment. This page explains the rules with examples — use it also to understand why an employee can't see or do something.
Five rules
1. Which assignments count?
- The assignments made to the person.
- The assignments made to the teams they belong to — but only if their In Team permission has Using Team Permissions on (in the default definitions: Team Captain). A Team Member does not use the team's inventory permission; they work on the work orders assigned to the team.
- If the person works for an expert company and is on another organization's inventory, the permission given to their company (see Partner permission).
Inactive people, teams and assignments are not counted.
2. The inventory chain
Only the assignments on the inventory itself and up its chain count. For the Electrical system the chain is: Harborview Hotels Group (organization) › Harborview Boston Waterfront (location) › Electrical — Power Distribution (system). Assignments on sibling locations or on the equipment below are not part of the calculation.
3. Permissions from a higher level
An assignment higher up passes down only through the lower-level part of its definition: if the Technician definition assigned on the location has Add System Permission on, the permissions in that part apply on the system. If it is off, the location assignment gives nothing on the system. For equipment both links of the chain (Add System Permission and Add Equipment Permission) must be on.
| Assignment | What it brings to the Electrical system |
|---|---|
| Organization: Organization Employee | Nothing: the definition has no Add Location Permission. |
| Boston hotel: Technician | The definition's system-level permissions (Add System Permission is on): view, open work orders and issue reports, work on work orders… |
| Electrical: ☆ manager (no definition) | No permission, but responsibility (rule 5). |
4. Combining: the widest wins
If several assignments give a permission on the same inventory, the widest value is taken for each permission:
Yes > Inventory Manager > No
| Permission | Assignment A | Assignment B | Result |
|---|---|---|---|
| Add work orders | Yes | No | Yes |
| Delete work orders | No | Inventory Manager | Inventory Manager |
| Forward work orders | No | No | No |
A No in one assignment does not take back a Yes from another; it only means "this assignment does not give this permission". To stop someone from doing something, find the assignment that gives the permission and remove it or replace it with a narrower definition.
5. Inventory responsibility
If the person is the inventory manager on the inventory itself or anywhere up its chain (or a team they captain is), the Inventory Manager values in the computed permission work like Yes. If not, they work like No.
Responsibility alone gives no permission: the manager must also get the permission from somewhere (the additional permission of the same assignment, or an assignment higher up). See Inventory managers.
Examples
Daniel: one definition, different systems
Daniel is a Technician at the Boston hotel and the manager of Electrical and Plumbing. Suppose the Technician definition has Delete work orders set to Inventory Manager.
| Inventory | Assignments counted | Computed result |
|---|---|---|
| Boston Waterfront (location) | Technician | Sees the inventory, opens work orders and issue reports; can not delete work orders (not the manager) |
| Electrical (system) | Technician (from above) + ☆ manager | The same and can delete work orders |
| HVAC — Central Plant (system) | Technician (from above) | Sees, opens work orders; can not delete |
| Chicago Loop (location) | — | Can not see it |
Marcus: two assignments combine
Marcus is the Location Manager at the Boston hotel. Even if he is also assigned Location Employee there, nothing changes: for each permission the widest value (the manager's) wins. To narrow Marcus's permission you must remove the Location Manager assignment.
Engineering Team: captain and member
The Engineering Team is assigned in Chicago as Technician and is the manager of the Chicago electrical system. The team's captain (Marcus) uses the Technician permissions and the responsibility there. A Team Member (Daniel) does not see the Chicago inventory through the team; the work orders assigned to the team appear in his My Work Orders and he works on them. To let a member see the inventory too, give them their own assignment there or turn on Using Team Permissions in their In Team permission.
Partner permission
When an expert company (e.g. Brightline Facility Services) works on the owner's inventory, the calculation has two steps:
- The company's permission: computed with the rules above from the owner's assignments to the company (Brightline: Service Contractor — System Maintenance on the HVAC systems).
- The employee's share: the company admin passes that permission on to employees or teams with External Permissions and chooses a limit. A permission passed to a team is used by the team's captain.
| Incoming Permission Limit Setting | The employee's permission |
|---|---|
| Full | The company's whole permission. |
| Company Permission | The company's permission, limited by the employee's permission in their own organization: for each permission, the narrower of the two. |
| Selected Permission | A permission definition you choose, limited by the company's permission: for each permission, the narrower of the two. |
- An employee who is in no external permission record can not see the customer's inventory.
- If there are several records (e.g. Selected Permission for the person, Company Permission for a team they captain), the results combine and the widest wins; a Full record always gives the whole permission.
- The company's permission is the ceiling of what it can pass on: a company can not give its employee a permission it was not given.
The Consultant switch is not a permission: it says that the company (or person) is on the reviewing side of the work orders on that inventory. For the review flow see Review and approval.
Why can't an employee see something?
More solutions: Troubleshooting.