Skip to main content

12. Role permission policies

A role permission policy makes a role's access narrower. It can never make a role's access wider than its built-in rights.

Who can do it: the Platform Super Administrator saves policies. The CSA can view them.

Before you start

  • Decide which role you want to narrow.
  • Know the workspace names: dashboard, finance, funding, risk, programmes, reports, stakeholders, users, roles, integrations, providers, audit, security, system and marketplace.
  • Know the actions: view, create, edit, approve, export and manage.
  • You must have a recent sign-in. Saving a policy needs fresh authentication.

Steps

  1. Open Roles & permissions (/roles).
  2. In the Role library, choose the role you want to change.
  3. Drag workspaces between Available workspaces and Granted access. You can also use Add or Remove.
  4. For each granted workspace, tick only the actions the role needs: View, Create, Edit, Approve, Export or Manage.
  5. Click Save role policy.

What happens next

  • The policy applies the next time the role's users act.
  • A role with no saved policy keeps its normal rights.

Common problems

  • You cannot add a right that the role does not already have. A policy only narrows. Change the role instead, or ask for a platform change.
  • You are not sure what a right does. Test with a demonstration account first (for example, one using @demo.dffms.org), not with a real staff member.