Permission Rules for Users with Multiple Roles
A user can be assigned multiple application roles at the same time. Different roles may have different data and operation permissions configured for the same worksheet. The system automatically merges these permissions to determine the user's final access level.
Core rule for multi-role permission merging:
When multiple roles have permissions configured for the same worksheet, the system merges permissions separately for each view. For the same permission level, the system applies the union of permissions (the highest permission level). However, lower-level permissions cannot exceed the restrictions defined by higher-level permissions.
Three Permission Levels
Worksheet data permissions are configured based on views. Permissions within each view are divided into the following three levels:
-
L1: Operation Permissions in a View
Controls whether users can perform the following actions in the current view:
- View records
- Edit records
- Delete records
L1 determines whether an operation is available. It is the prerequisite for L2 and L3 permissions to take effect.
For example, if record editing is disabled in the current view, users cannot edit records even if L2 allows editing all records and L3 allows editing all fields.
-
L2: Record Access Scope
When an operation is enabled in L1, L2 further determines which records users can perform the operation on.
For example:
- Whether users can view all records or only records they are involved in
- Whether users can edit all records or only records they own
- Whether users can delete all records or only records within a specified range
-
L3: Field and Feature Permissions
When users can view, create, or edit a record, L3 further controls the fields and features they can access, including:
- Fields visible or editable when creating records
- Fields visible when viewing records
- Fields editable when editing records
- System features such as discussions, sharing, importing, and printing
- Custom actions
When Are Multi-Role Permissions Merged?
Multi-role permission merging only applies when multiple roles assigned to the same user have permissions configured for the same worksheet.
For example:
- Role 1 has operation permissions configured for Worksheet A.
- Role 2 also has operation permissions configured for Worksheet A.
When the user is assigned both roles, the system merges the permissions from both roles for Worksheet A.
If multiple roles have permissions configured for different worksheets, there is no permission conflict and no permission merging is required.
For example:
- Role 1 only has operation permissions configured for Worksheet A.
- Role 2 only has operation permissions configured for Worksheet B.
After the user is assigned both roles:
- Worksheet A uses the permissions from Role 1.
- Worksheet B uses the permissions from Role 2.
How Are Multi-Role Permissions Merged?
The system merges permissions according to the following process:
- Identify worksheets where multiple assigned roles have permission configurations.
- Identify permissions separately for each view in the worksheet.
- Divide each role's permissions under the same view into three levels: L1, L2, and L3.
- Merge permissions at the same level by taking the union (the highest permission level).
- Determine the user's final permissions based on the dependency between L1, L2, and L3.
The permission merging rule can be summarized as:
For the same worksheet, the same view, and the same permission level, permissions are merged by taking the union (the highest permission level). Higher-level permissions determine whether lower-level permissions can take effect.
Specifically:
- L1 determines whether an operation is allowed.
- L2 determines which records the operation applies to.
- L3 determines which fields and features can be accessed.
Even if broader permissions are configured in L2 or L3, they will not take effect unless the corresponding operation is enabled in L1.
Example 1
Role 1 Permission Configuration:
Role 2 Permission Configuration:
Merged Permissions:
Both roles have permissions configured for the same worksheet, so the permissions need to be merged.
The system compares the L1, L2, and L3 permissions of each role for each view, then merges permissions at the same level by taking the union (the highest permission level). The result is the user's final permissions for each view.
Download the Permission Merging Rules Table
Example 2
Role 1 Permission Configuration:
Role 2 Permission Configuration:
Merged Permissions:
Both roles have permissions configured for the same worksheet, so permission merging applies.
As shown below, view permissions are organized into three levels. Permissions at the same level are merged by taking the union (the highest permission level), resulting in the user's final permissions for this view.
Why Are Role 1 Permissions Different Between View A and View B?
In Role 1:
- L2 is configured to allow editing all records.
- L3 is configured to allow editing all fields.
- However, L1 in View B does not allow record editing.
Therefore, the editing permissions configured in L2 and L3 do not take effect in View B.
In View B, the user:
- Cannot edit any records.
- Cannot edit any fields.
This demonstrates that L2 and L3 permissions cannot take effect independently. The corresponding operation must first be enabled in L1 before lower-level permissions can apply.
Was this document helpful?