Key Concepts: Role-based Access

charthop’s role based access controls enable you to define who (the user) can do what (the action) for which part of the platform (the entity) for example, you might say that the ceo (the user) is allowed to read (the action) the data for all employees (the entity) in the system or you might say the head of recruiting (the user) is allowed to create (the action) new hires (the entity) in the system to do this, users are assigned a specific role, and those roles contain an explicit set of permissions, which define what that role has access to see and do permissions and roles permissions enable you to either allow or deny access to a specific entity, data point, page, or process inside charthop you can read more about permissions in defining a custom permission https //docs google com/document/d/1qh8ijyrfqncqghv9r8m 5pddjjdl6rwlfrehce2ajj4/edit#heading=h bdgre1ue05r roles are a collection of permissions that dictate what a user can and can not see or do inside charthop you can read more about roles in defining a custom role https //docs google com/document/d/1qh8ijyrfqncqghv9r8m 5pddjjdl6rwlfrehce2ajj4/edit#heading=h fgm1y5djuvmt 💡an analogy to help you visualize you can think of permissions as keys that unlock areas of the charthop platform you can think of a role as the keychain that holds the keys a role (keychain) holds many permissions (keys) that grant or deny access to parts of charthop deny always beats allow if a role contains two conflicting permissions, the deny permission will always win for a very simple example, consider a role with the following two permissions allow person\ read deny person\ read a user with this role would not have access to see any person data, because the deny permission “beats” the allow permission let’s consider a more nuanced example, such as a role with the following two permissions allow job\ read deny job\ read fields \[“basecomp”] in this example, the allow gives the user access to see – read – all fields on job but the deny means that this user is not allowed to see – read – the field basecomp on jobs even though the allow permission technically gives the user access to read all job fields, the deny in this case wins, so this user can see all job fields except base compensation packages basic basic | | headcount planning headcount planning | compensation reviews compensation reviews | performance performance | engagement engagement | hris