Skip to content
Identity and Access Management

Role Management

Role management in IAM follows the RBAC (Role-Based Access Control) style of authorization. This allows for fine-grained access control over your resources, providing a flexible and robust way to manage your authorization needs.

With Permissions, you can create permission sets based on the type of resource you own. With Roles, you can combine one or more permissions to form a rule that dictates what specific personas in your project can do.

Let’s understand role management with the help of a use case.

User Access Management in a Construction Project

Scenario:

A construction company is using a cloud-based platform to manage a large construction project. The platform has various functionalities, including project planning, document management, and communication tools.

Business Rules:

Below are the business rules based on the personas/actors involved in the project:

  • Project Manager:
    • Can create, update, and delete projects.
    • Can assign roles to users within a project.
    • Can access all documents and communication related to the project.
  • Site Engineer:
    • Can view and update project plans.
    • Can upload and download documents related to their assigned tasks.
    • Can participate in project-related communication.
  • Subcontractor:
    • Can only access documents and communication related to their assigned tasks.

Definitions:

  • Actors:
    • Project Manager, Site Engineer, Subcontractor
  • Actions:
    • Create (Project), Update (Project), Delete (Project), Assign (Roles), Access (Documents, Communication), Upload (Documents), Download (Documents), Participate (Communication), View (Project)
  • Resource Types:
    • Project, Role, User, Document, Communication, Task

Pictorial Representation Image

Sample Permission

{
   "resource": "project",
   "action": "create",
   "description": "access to create a project"
}

Sample Role

{
   "name": "Project Manager",
   "permissionList": [
       "<project create permission id>", "<project view permission id>"
   ]
}

With the above defined permissions & roles authorization can be easily achieved around the business need

Device Role Assignment

You can also assign roles to devices.For detailed implementation steps, see the Device Role Assignment Guide.