The dynamic permission model
kommuns does not give people a fixed role. What a person can see and do on a location, system or piece of equipment is computed from the assignments made to them (and to their team and company) on the inventory. We call the result the computed permission, and the whole approach the dynamic permission model.
In short: you don't say "Daniel is a technician". You say "Daniel works at Harborview Boston Waterfront with the Technician permission and is the inventory manager of the Electrical system". kommuns computes Daniel's permission on the Electrical system from these two assignments.
Why not roles?
In a classic role model everyone is put in one box and the box gives everyone the same rights. If a technician works in only one building, or a contractor should only reach the HVAC system, you have to invent new roles — and the number of roles grows fast.
In the dynamic model, what can be done (the permission definition) is separate from where (the assignment). You give the same definition to different people in different places; a person's real permission is the sum of their assignments.
| Classic role model | kommuns: dynamic permission model | |
|---|---|---|
| What does a person get? | One role (e.g. Technician) | Assignments on the inventory (e.g. Technician at the Boston hotel, manager of Electrical) |
| Where does it apply? | The same everywhere | Computed separately for each inventory |
| A new building, a new partner | Invent a new role | Make a new assignment |
| When the assignment is removed | Update the role by hand | The permission goes away by itself |
What you gain:
- A few permission definitions are enough. You reuse Technician, Location Manager and a few others everywhere.
- The permission is where the work is. Assign someone to a new building and their permission exists there too; remove the assignment and it disappears by itself.
- Controlled access for partners. A service company gets a permission only on the system it maintains; it can pass it on to its own employees only within its own limits.
- Responsibility becomes permission. Mark a permission as Inventory Manager and it works only on the inventory the person is responsible for. Make them manager of another piece of equipment and the permission follows.
The building blocks
The dynamic permission model has three parts.
- Permission definition (what?): a list of permissions. For example Technician: sees the inventory, opens work orders and issue reports, works on work orders; can not delete or forward. Definitions live under Organization › Permissions; use the defaults or create your own.
- Inventory (where?): your organization is a tree: organization › location › system › equipment › sub-equipment.
- Assignment (who, where, with which definition?): links an assignee to a node of the inventory with a permission
definition. The assignee can be an employee, a team or an expert company. An assignment has two more
switches:
- Inventory manager: the assignee is primarily responsible for this inventory (see Inventory managers).
- Consultant: the assignee reviews and approves the work orders on this inventory (see Review and approval).
Where you make assignments:
| Assignment | Where? |
|---|---|
| At the organization level | When inviting an employee (Permission Selection) or with Edit Permission in Assignees › Employees |
| On a location, system or equipment | Assign on that inventory's Assignees tab |
| Inside a team | Team Captain / Team Member when creating or editing the team |
| For an expert company's own employees | Expert › Business Partners › External Permissions (delegating) |
Permissions from inventory assignments
Each assignment gives the person a permission on that inventory (and, if the definition allows, below it). In our example organization, Harborview Hotels Group, the assignments look like this:
- Daniel's organization-level permission is limited (Organization Employee). His Technician assignment at the Boston hotel lets him work there and on the systems below. Because he is the manager of Electrical and Plumbing, the permissions marked Inventory Manager also open on these two systems. Without an assignment in Chicago he does not see the Chicago inventory.
- Brightline Facility Services sees only the HVAC systems; it can not reach the hotel's other systems.
- Sofia at the front office sees the Boston inventory and reports issues, but can not change work orders.
- The Engineering Team's permission in Chicago is used by the team's captain (see Teams).
How a person's permission on a given inventory is computed step by step is explained in How your permission is computed.
Kinds of permission definitions
Each definition is for one inventory level; you can choose it in assignments at that level.
| Kind | Assigned where? | Example |
|---|---|---|
| Organization | On the organization itself (employee invitation, Edit Permission) | Organization Admin, Organization Employee |
| In Team | To the members of a team | Team Captain, Team Member |
| Location | On a location | Location Manager, Location Employee, Technician |
| System | On a system | Service Contractor — System Maintenance |
| Equipment / Sub-Equipment | On a piece of equipment or a part | Generator testing |
Passing down to lower levels
A definition can include permissions for the inventory below the level it is given on: Add Location Permission in an Organization definition, Add System Permission in a Location definition, Add Equipment Permission in a System definition, Add Sub-Equipment Permission in an Equipment definition. If these parts are not turned on, the assignment applies only at the level where it is given.
Every link of the chain must be on: if Add System Permission is off in the location definition, the Equipment permissions below it are not used either.
The default Organization Employee definition has no Add Location Permission part. An employee invited with it does not see the inventory until they are assigned on a location or system. This is deliberate: a newcomer sees only the places given to them.
Three-state permissions
For each permission in a definition you choose one of three options:
| Option | Meaning |
|---|---|
| Yes | Allowed everywhere the assignment applies. |
| Inventory Manager | Allowed only on the inventory the person (or the team they captain) is the manager of, and below it. |
| No | Not allowed. |
Inventory Manager is the most powerful part of the dynamic model: one definition gives everyone their own area. For example, if Work orders › Delete is Inventory Manager in the Technician definition, Daniel can delete work orders only on Electrical and Plumbing, while a colleague who manages the Pool and Spa can delete only there.
Default permission definitions
Six definitions come with every new organization:
| Permission | Kind | Description |
|---|---|---|
| Organization Admin | Organization | All permissions on the organization. Given to the person who creates it. |
| Organization Employee | Organization | Limited permissions; does not show the locations (see the note above). |
| Location Manager | Location | All permissions on the location and the inventory below it. |
| Location Employee | Location | Sees the location and reports issues. |
| Team Captain | In Team | All permissions in the team; uses the inventory permissions given to the team. |
| Team Member | In Team | Limited permissions in the team; works on the work orders assigned to the team. |
See them under and create new ones as needed.
A new organization's default definitions are currently created with Turkish names (Organizasyon Yöneticisi, Organizasyon Çalışanı, Lokasyon Yöneticisi …). You can rename them on the Permissions page; the demo organizations in this guide use the English names above.
The name you see on the organization card in the Lobby and in the Permission column of Assignees › Employees (e.g. Organization Employee) is only the person's organization-level assignment. Their real permission on a location or system is computed by adding their assignments on the inventory.
Teams: captain and member
You can assign a team to the inventory too. Not everyone in the team uses the permission of the team's assignment — only those whose In Team definition has Using Team Permissions turned on. In the default definitions it is on for Team Captain and off for Team Member.
Team members see and work on the team's work orders in My Work Orders; to act on the rest of the inventory, give them their own assignments. See Teams.
Business partners: a permission given to a company
An assignee can also be an expert company. The owner assigns the company only on the systems concerned (e.g. Brightline on the HVAC systems with Service Contractor — System Maintenance). The permission belongs to the company first; its employees use it only when the company admin passes it on with External Permissions, and only up to the limit chosen there.
The limit options and the calculation: How your permission is computed.
Permission Settings: how assignees join the organization
Employees, expert companies and teams you assign on a location or system are also linked to your organization (they get an organization-level assignment). Choose which definition that assignment uses under Permission Settings (Company Permission) at the top right of Organization › Permissions. The default is Organization Employee. Only Organization definitions can be chosen; people who may edit Permissions can change it.
Permissions in an Organization definition
An Organization definition grants permissions on:
- Files and Tags: view, add; view hidden tags
- Permissions, Categories, Brand & Model, Company Calendar, Plans and Payment, Other Company Settings, Integrations (Integrations (API)): view and edit
- Log Records: view
- Assignees, Recurring Work Orders, Feedback, Forms, Work orders, Locations: view and add
- Add Location Permission: the definition also applies on locations (and the levels below)
The side menu is shaped by your organization type, your computed permission and your plan. If you can't see an item, ask your Organization Admin for the assignment. See Troubleshooting.