Company roles
Review practical small-company role bundles and the exact system/custom authorities beneath them, and govern bounded custom roles.
Screen orientation
Company administration is required for role mutation. Role and assignment summaries are tenant-scoped; system roles remain immutable.
Practical roles appear first with their effective authority and assignments. Advanced control authorities retain exact technical roles; the editor is only for permitted tenant custom roles.
Field reference
The entries below describe the current screen controls and read-only values. They do not relax server-side validation, site scope, classification handling or required independence in a governed decision.
| Field or value | Control | Required or shown when | How to use or read it | Result |
|---|---|---|---|---|
| Authority name | Text | Required for a custom role. | Use a clear company-facing role name. | Creates the tenant-scoped display identity. |
| Authority code | Text | Required and unique for a custom role. | Use a stable controlled code; system-role codes cannot be replaced. | Creates the authorization identity. |
| Purpose and boundaries | Long text | Required. | Explain intended responsibilities and exclusions. | Becomes the role's governed description. |
| Practical company role | Read-only bundle | Derived. | Use the bundle to provision common small-company responsibilities. | Maps to exact existing technical authorities. |
| Effective permissions | Permission selector/read-only summary | Required for custom role changes. | Choose only delegable catalogue permissions. | Defines server-loaded authorization on future requests. |
| Assigned-user count | Read-only count | Derived. | Review active assignments before changing a custom role. | Shows operational impact without changing users. |
| Advanced control authorities | Read-only catalogue | Derived. | Inspect exact role codes when a workflow requires a specialist authority. | Explains maker-checker identities. |
Actions and effects
When to use: When a practical bundle does not fit and a bounded delegable role is approved.
What it does: Creates a tenant role from the server-controlled permission catalogue.
When to use: For an existing tenant role.
What it does: Changes future effective permissions with audit evidence; system roles remain unchanged.
Lists and states
- Practical-role cards show bundled authorities and assignments.
- Advanced authority register distinguishes immutable system roles from editable tenant custom roles.
Authority boundary
Roles define permission only. They do not assign sites/clearance by themselves, bypass exact-role workflow checks or mutate business records.