Security roles and permissions

A security role is a set of permissions that is assigned to users. When you change the permissions for a role, all the users in that role are affected. Your changes are saved automatically if you navigate to the previous or next role.

You may need to grant a combination of feature, record, and field permissions to allow a specific action such as creating reports. For more details, see Permissions guide.

  1. Open the settings.
  2. In Portfolio settings section of the menu, select Security Roles.
  • In the security role settings, select the role.

In the security role settings, the permissions are organized on the following tabs:

  • Features: The permissions for the modules and features.
  • Records: The permissions for each item type.
    • To select the Create, Comment, or Modify permissions, the View permission must be selected first.
    • To select the Remove permission, the Modify permission must be selected first.
    • To select or remove permissions for a group, select or clear the checkbox at the group or parent level.

    Permissions are organized in the following way:

    1. Group
    2. Parent
    3. Child
    Example of group, parent, and child permissions.

    You can expand each group to see which permissions are selected.

  • Fields: The field-level permissions for each item type.
    • Read permission icon(View): Users can see the field but can't edit it.
    • Edit permission icon (Modify): Users can see and edit the field.
    • No permission icon (No access): Users can't see the field.
    • Child permission icon: Permissions for this group are set at the child level.

    If the user doesn't have the View or Modify permission for system-required fields, they're still available:

    • For drawing sets and records that use the Draft workflow status. After the item is saved in a non-draft status, the field permissions are enforced.
    • In the Add Budget Item and in the Create dialogs for records such as financial records. The field permissions are enforced in the full record.

You can create a role or copy an existing role and then edit the permissions assigned to it. You can also mark one role as the default security role so that it's assigned automatically to new users.

Default security role in grid

Default role in the security role settings and the user settings

The Portfolio Administrator role can't be marked as the default role.

  1. On the navigation toolbar, select Create icon (Create).
  2. In the Information panel, enter a name and description for the role.
  3. To assign this role automatically to new users, turn on the Default toggle.
  4. On the Features tab, select the checkboxes to grant access to the modules and features.

    5. Custom reports aren't selected automatically in the Reports group.

  5. On the Records tab, select the permissions for each type.
  6. On the Fields tab, edit the field permissions for each item type.
    1. From the list, select the item type.
    2. To expand a group, select the arrow.
    3. To change the field permission, select the permission icon.
  7. To save the changes and keep the role open, select Save icon (Save).

    8. —Or—

    To save the changes and close the role, select Back arrow (Save).

  1. Open the role.
  2. On the navigation toolbar, select Copy icon (Copy).
  3. On each tab, edit the features and permissions for the new role.
  4. To save the changes and keep the role open, select Save icon (Save).

    5. —Or—

    To save the changes and close the role, select Back arrow (Save).

  1. Open the role.
  2. On each tab, edit the features and permissions.
  1. Open the role.
  2. In the right-side panel, edit the role name and description.
  1. Open the role.
  2. In the Information panel, turn on the Default toggle.

    3. The toggle for the previous default role is turned off automatically.

    To turn off the Default Role toggle for a role, turn it on for a different role.

You can only delete roles that aren't associated with any users or workflow status permissions.

  • In the view, on the role, select More icon (More) > Remove.

    • —Or—

    Select More icon (More) > Delete Selected Records.