About access rights for roles

After you have installed Visma.net ERP and created user roles, all roles that you have created have the Not set access level set to all workspaces, and windows.

Important: The Not set access level indicates that all roles have access to the workspace until Revoked or Granted access rights are set to the workspace for at least one role.
All roles with the Not set level are then denied access to the module.

You need to set up the access rights that roles have to the system objects (workspaces and windows) that will be used by users with the roles in their work.
The most frequent scenarios of access rights setup are the following:

• The role should have access to all workspaces and windows within the workspace and all windows within it.
  For example: Suppose that chief accountants should work with all its workspaces and windows.
  For the role you define for chief accountants, you can specify access rights level to a system object on a higher level and apply this access rights level to all nested objects.
  For a detailed procedure, see: Initially configure access rights.
• Users with the role should work with particular workspaces within a module and with particular windows.
  For example, suppose that junior accountants should work only with particular windows within the Supplier ledger workspace.
  For the role you set up for these accountants, you need to set up access rights to nested system objects manually.
  For a detailed procedure, see: Configure access rights for a selected user role.

During ongoing maintenance of Visma.net ERP, you may have tasks to change roles' access rights to some system objects (workspaces, windows and window elements).
You can change these access rights in different ways, depending on your task:

• If you want users with a particular role to work with all windows within a module, for the role, you set the Granted access level for all workspaces, and the Delete access level for all windows within all workspaces.
• If you want to hide a workspace from users with a particular role in the Visma.net ERP user interface so these users cannot work with it (for example, warehouse workers should work only with the Inventory and Help workspace and should not see all other workspaces in the system), you set the Revoked access rights level for all workspaces and windows within the module.
• Suppose you want to forbid a particular role's access to a workspace and its nodes but permit access to a particular window within the workspace so that a user with the role can access it from another window.
  For example: A user with the Junior system administrator role should not have access to the Organisation workspace as a whole, but he or she needs to use Employees (EP203000) window to create user accounts.
  In this case, for the role, you set the Revoked access rights level to the workspace and the Delete access level to the window.
• If you want to restrict access to a particular window element (for example, only a user with the Chief accountant role can release documents in the Customer payments (AR302000) window), you set the Edit access rights level to this element for the role that should use it, and the Revoked access rights level for all roles that should not use it.
• If you need to reset access rights for a user role to whole workspaces, you can reset access rights to Not set for this role to all workspaces and windows within the workspace.
  For a detailed procedure, go to: Reset access rights to a suite or a module.