Help and support

Managing Roles and Authorizations in Artificio

Artificio employs a robust and flexible role-based access control (RBAC) system, ensuring users have the appropriate permissions for their roles within the organization. This section guides you through managing roles and authorizations within the Artificio platform.

The Super Administrator Role

The first user account created in Artificio automatically assumes the Super Administrator (Super Admin) role. This role is crucial as it's responsible for setting up and managing all other user accounts and their respective roles.

Responsibilities of a Super Admin:

• User Management: Create new user accounts, assign users to teams, and manage user details.
• Role Creation: Create custom roles tailored to your organization's specific needs and structure.
• Authorization Management: Define and manage access levels for each role across various Artificio applications.
• Account Settings: Manage and edit account-level details.

These functions are accessible within the "Administration" section of Artificio, typically under a "Super Admin" tab.

Core Concepts of Role-Based Access Control

Artificio's RBAC system is built on the following key concepts:

1. Resource Categories: Organize resources (e.g., "Data Views," "Data Flows," "Designs") into logical categories. This allows for easier management of permissions across related resources. Super Admins can create, edit, and delete these categories.
2. Resources: Individual elements within a category. For example, within the "Data Views" category, individual data views would be the resources.
3. Roles and Permissions: Define roles (e.g., "Data Analyst," "Manager," "Sales Representative") and assign specific permissions to each role for each resource category. The available permissions typically include:
   • Read: Allows viewing data, including accessing designs and dataflows.
   • Write: Allows creating new data records. Requires "Read" permission.

   • Edit: Allows modifying existing data records. Requires "Read" and "Write" permissions. Note: "Edit" does not grant the ability to delete data. A separate "Delete" permission may be required (if applicable).

      

4. Teams: Group users into teams. Assign roles to teams. Users inherit the permissions associated with the roles assigned to their team. A user's permissions are determined by the roles assigned to their team. Users typically belong to a single team.

Defining Permissions: Include vs. Exclude

When defining permissions for a role on a resource category, you can use "Include" or "Exclude":

• Include: Grants access only to the resources specifically selected.
• Exclude: Grants access to all resources within the category except those specifically selected.

"Include" and "Exclude" are mutually exclusive. You cannot both include and exclude the same resource.

Putting it Together: The Permission Flow

Permissions flow from resources to roles to teams to users:

1. Super Admins define Resource Categories and the individual Resources within them.
2. Super Admins create Roles and assign Permissions (Read, Write, Edit, Delete - if applicable) to those roles for specific Resource Categories and Resources, using "Include" or "Exclude."
3. Super Admins create Teams and assign Roles to those Teams.
4. Users are assigned to Teams.
5. A user's permissions are determined by the Roles assigned to their Team.