Roles and permissions

Every person in your organisation has a role, such as Branch Manager or Collection Officer. Each role comes with a set of permissions: the things people with that role may do. Your organisation decides these. For example, you can decide whether Branch Managers may disburse a loan with an earlier date, or whether Area Managers may record collections.

Every role starts with the standard permissions listed on Roles and permissions. Nothing changes until someone changes it here.

Who can change permissions

Anyone whose role has the Edit role permissions permission. As standard that is the Proprietor and Admins. The screen is Administration > Roles & Permissions. People who can view the audit log can open it too, to read the separation-of-duties rules and conflicts.

Changing what a role may do

1. Open Administration > Roles & Permissions.
2. Choose the role from the tabs across the top. The number next to each role is how many active people have it.
3. Tick the permissions the role should have and untick the ones it should not. Each permission has a short explanation underneath it.
4. Select Save changes.

The change applies straight away to everyone with that role. The system checks it on their very next action. Their menus and buttons update the next time they open or refresh a page.

A permission that differs from the standard setting is marked Not standard. To put a whole role back to the standard permissions, select Reset to standard. Discard throws away changes you have not saved.

Rules that keep your organisation safe

• The Proprietor role cannot be changed. It always has every permission, so an organisation with a Proprietor can never lock itself out.
• You can only give or take away permissions you have yourself. Permissions you do not have are greyed out.
• Someone must always be able to change permissions. The system refuses a change that would leave nobody in the organisation with Edit role permissions. This applies here, and also when changing or deactivating a user on the Users screen.
• Every change is recorded in the audit log, with who made it and which permissions were given or taken away.

Separation of duties

Some permissions are risky in one person's hands. Someone who can record collections and record them for an earlier day could hide a shortfall; someone who can create, approve and disburse a loan needs nobody else to pay money out. The Separation of duties tab lists these combinations as rules.

Rule	The permissions it keeps apart
Create, approve and pay out a loan	Create loan applications, Approve loans at own step, Disburse loans
Record and back-date collections	Record collections, Back-date collections
Record contributions and waive charges	Record contributions, Waive savings charges
Money into and out of savings	Record contributions, Pay out savings
Handle cash and count the till	Record cash movements, Count cash
Set fees and waive charges	Edit fees, Waive savings charges
Manage members and role permissions	Manage members, Edit role permissions

Each rule has a severity:

• Off - not checked.
• Warn (the standard) - a change that gives someone the whole combination is saved, and you see a warning naming the rule.
• Refuse - a change that would give someone new the whole combination is refused, whether it is a change to a role's permissions, a change of someone's role, or an invitation. People who already hold it keep it; they are listed on the Conflicts tab so you can decide what to do.

To change a severity, choose it from the rule's Severity list. To add a rule of your own, fill in Add a rule of your own at the bottom: a name, why it is risky, two to four permissions and the severity. You can delete your own rules; the standard rules can only be switched off.

Conflicts

The Conflicts tab shows, for each rule, which roles and which people currently hold the whole combination. The Proprietor is not listed: that role holds every permission by design. As standard, Admins and Branch Managers appear under several rules: that is how the roles were set up before, and the tab lets you see it. People who can view the audit log can also open this tab, but cannot change anything.

Every rule change, and every change refused by a Refuse rule, is recorded in the audit log.

Examples

You want to...	Do this
Stop Branch Managers disbursing loans with an earlier date	Branch Manager tab, untick Back-date disbursements, save.
Let Area Managers disburse loans	Area Manager tab, tick Disburse loans, save. Area Managers see the Disburse Loan button from their next page load.
Let one more role see reports	Tick View reports on that role's tab, and save.
Make sure nobody new can both record and back-date collections	Separation of duties tab, Record and back-date collections, severity Refuse.

caution

A permission given to a role reaches everyone with that role. To give one person more, change their role on the Users screen instead.