Permissions: the feature that decides whether a rollout survives
Access control is treated as a checkbox during evaluation and becomes the most-discussed feature during rollout. It is where an implementation meets the customer's actual organisational structure — including the parts of it nobody wanted to describe out loud.
1 min readOadbox
Roles are not enough on their own
A role says what kind of user someone is. Real organisations need scope as well: this accountant, for these two branches; this teacher, for these sections; this manager, for their own team's records only.
Products that model roles without scope end up creating a role per person, which is the same as having no model at all.
Four dimensions worth separating
- Action — can this person create, read, update, approve, or export?
- Scope — over which branch, class, plant, route or cost centre?
- Field — can they see the salary column, the margin, the phone number?
- State — can they edit a document after it is approved, or only reverse it?
Most access requirements we meet are expressible as a combination of these four. Products that only offer the first end up implementing the rest as custom code per customer.
Export is a permission
The most common data loss event in business software is not a breach. It is an employee downloading the customer list before resigning.
Treating export as a distinct, logged, restrictable action — rather than a convenience attached to every grid — costs almost nothing and closes the most likely route by which a customer's data actually leaves.
Make it inspectable
Administrators need to answer two questions quickly: what can this person see, and who can see this thing? Both are hard to answer from a matrix of checkboxes and easy to answer from a screen built to answer them.
Products that provide it get sensible permission structures. Products that do not get everybody made an administrator within six months, which is how the rollout quietly loses its controls.
Written by the Oadbox team. Something here not match how it works in your business? We would genuinely like to hear it — connect@oadbox.com.