[docs] Add permissions documentation #194
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Good job with the documentation, I think all the informations are here. I think we can do better with the intro but I think JB can write that part. Also a question: should we mention the fact that we are removing auto grants? |
heditar
reviewed
Sep 10, 2025
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role (e.g. "Platform role") 3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ... > **Note:** if you check a capability with **Delete**, the corresponding **Manage** and **Access** permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it. 4. Save the role.> **Note:** If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.---## How to assign a role to a userIn OpenAEV, roles are not assigned directly to users. Instead, they are linked through **groups**.1. Go to **Settings → Security → Groups**.2. Create a group. 3. In the group options, assign: - One or more **roles** (defining the capabilities for this group). - One or more **users** (who will inherit the group’s roles). ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Special Cases- **Simulations, Scenarios, and Atomic Testing** - A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).- **Payloads** - Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability.---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---## Default Read AccessSome elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone:- **Teams**- **Players**- **Taxonomies** (in the Settings)Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
(which overrides individual grants
not sure we should say it overrides
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role (e.g. "Platform role") 3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ... > **Note:** if you check a capability with **Delete**, the corresponding **Manage** and **Access** permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it. 4. Save the role.> **Note:** If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.---## How to assign a role to a userIn OpenAEV, roles are not assigned directly to users. Instead, they are linked through **groups**.1. Go to **Settings → Security → Groups**.2. Create a group. 3. In the group options, assign: - One or more **roles** (defining the capabilities for this group). - One or more **users** (who will inherit the group’s roles). ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Special Cases- **Simulations, Scenarios, and Atomic Testing** - A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).- **Payloads** - Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability.---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---## Default Read AccessSome elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone:- **Teams**- **Players**- **Taxonomies** (in the Settings)Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
Note: if you check a capability with Delete, the corresponding Manage and Access permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it.
Maybe something like this — it’s a bit more descriptive
Permissions are organized hierarchically by indentation: selecting a permission further to the right (e.g., Delete) will automatically enable the less-indented ones that precede it (e.g., Manage and Access).
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role (e.g. "Platform role") 3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ... > **Note:** if you check a capability with **Delete**, the corresponding **Manage** and **Access** permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it. 4. Save the role.> **Note:** If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.---## How to assign a role to a userIn OpenAEV, roles are not assigned directly to users. Instead, they are linked through **groups**.1. Go to **Settings → Security → Groups**.2. Create a group. 3. In the group options, assign: - One or more **roles** (defining the capabilities for this group). - One or more **users** (who will inherit the group’s roles). ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Special Cases- **Simulations, Scenarios, and Atomic Testing** - A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).- **Payloads** - Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability.---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---## Default Read AccessSome elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone:- **Teams**- **Players**- **Taxonomies** (in the Settings)Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
How to assign a role to a user
In OpenAEV, roles are not assigned directly to users. Instead, they are linked through groups.
The objective here is to explain how to assign a role to a group and assign a user to it. You already mentioned this in the first paragraph: each user belongs to a group, and that group has one or more roles that define its permissions.
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role (e.g. "Platform role") 3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ... > **Note:** if you check a capability with **Delete**, the corresponding **Manage** and **Access** permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it. 4. Save the role.> **Note:** If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.---## How to assign a role to a userIn OpenAEV, roles are not assigned directly to users. Instead, they are linked through **groups**.1. Go to **Settings → Security → Groups**.2. Create a group. 3. In the group options, assign: - One or more **roles** (defining the capabilities for this group). - One or more **users** (who will inherit the group’s roles). ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Special Cases- **Simulations, Scenarios, and Atomic Testing** - A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).- **Payloads** - Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability.---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---## Default Read AccessSome elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone:- **Teams**- **Players**- **Taxonomies** (in the Settings)Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
It could be useful to illustrate the first part with a persona — for example, a tabletop content manager:
- Full rights on players, teams, and organizations
- No rights on payloads
What do you think?
Same for grants use case.
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role (e.g. "Platform role") 3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ... > **Note:** if you check a capability with **Delete**, the corresponding **Manage** and **Access** permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it. 4. Save the role.> **Note:** If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.---## How to assign a role to a userIn OpenAEV, roles are not assigned directly to users. Instead, they are linked through **groups**.1. Go to **Settings → Security → Groups**.2. Create a group. 3. In the group options, assign: - One or more **roles** (defining the capabilities for this group). - One or more **users** (who will inherit the group’s roles). ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Special Cases- **Simulations, Scenarios, and Atomic Testing** - A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).- **Payloads** - Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability.---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---## Default Read AccessSome elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone:- **Teams**- **Players**- **Taxonomies** (in the Settings)Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
I think we have an indentation issue here
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role (e.g. "Platform role") 3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ... > **Note:** if you check a capability with **Delete**, the corresponding **Manage** and **Access** permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it. 4. Save the role.> **Note:** If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.---## How to assign a role to a userIn OpenAEV, roles are not assigned directly to users. Instead, they are linked through **groups**.1. Go to **Settings → Security → Groups**.2. Create a group. 3. In the group options, assign: - One or more **roles** (defining the capabilities for this group). - One or more **users** (who will inherit the group’s roles). ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Special Cases- **Simulations, Scenarios, and Atomic Testing** - A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).- **Payloads** - Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability.---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---## Default Read AccessSome elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone:- **Teams**- **Players**- **Taxonomies** (in the Settings)Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
For readability, I think it’s simpler to start with the types of grants and then move on to the special cases.
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role (e.g. "Platform role") 3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ... > **Note:** if you check a capability with **Delete**, the corresponding **Manage** and **Access** permissions will automatically be selected as well. This is because it is not possible to delete something without first being able to access and manage it. 4. Save the role.> **Note:** If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.---## How to assign a role to a userIn OpenAEV, roles are not assigned directly to users. Instead, they are linked through **groups**.1. Go to **Settings → Security → Groups**.2. Create a group. 3. In the group options, assign: - One or more **roles** (defining the capabilities for this group). - One or more **users** (who will inherit the group’s roles). ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Special Cases- **Simulations, Scenarios, and Atomic Testing** - A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).- **Payloads** - Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability.---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---## Default Read AccessSome elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone:- **Teams**- **Players**- **Taxonomies** (in the Settings)Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
This section should be presented as a warning, perhaps placed directly in the first paragraph?
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.!!! warning "Default read access" Some elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone: - **Teams** - **Players** - **Taxonomies** (in the Settings) Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ...4. Save the role.!!! info "Hierarchical permissions" Permissions are organized hierarchically by indentation: selecting a permission further to the right (e.g., Delete) will automatically enable the less-indented ones that precede it (e.g., Manage and Access).!!! tip "Bypass" If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.### Example : Crisis content creator!!! tip "Role : Crisis content creator"**Context:** This user is in charge of designing crisis management content. Their role is to create **scenarios** that can later be reused by other teams to run exercises. For example, they might build an **“Earthquake Crisis Scenario”**.**Capabilities:** - **Security platforms** : Manage groups to assign them grants - **Assessment** : Create scenarioWith this role, the user can design new scenarios, and configure everything needed to prepare exercises. For instance, they may create a **“Earthquake Crisis Template”**, which becomes the foundation for future simulations.Then, the user will be able to create scenario, launch it and grant their team on this simulation. ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---### Example : Local coordinator!!! tip "Role : Local coordinator" **Context:** This user is not a global content creator. Instead, they are trained locally to run a specific simulation designed by the content creator. They do not need all capabilities — only access to the resources explicitly granted to them.**Grants assigned through their group:** - **Simulation** → *Launch* on the simulation based on the “Earthquake Crisis”**Concrete workflow:** - The **Content Creator** travels to the **French Embassy** and trains a local coordinator. - This coordinator is granted launch to the simulation created from the *Earthquake Crisis Scenario*. - The coordinator can now run and manage this simulation, but cannot see or modify other simulations or scenarios. - Later, the same process is repeated at the **UK Embassy**, where another coordinator is granted launch only to the local simulation derived from the same scenario.---### Special Cases!!! tip "Simulations, Scenarios, and Atomic Testing" A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).!!! tip "Payloads" Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability. ---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
I checked on CTI, and we’re going with capabilities directly without mentioning permissions, to make things clearer.
https://docs.opencti.io/latest/administration/users/?h=permission#list-of-capabilities
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.!!! warning "Default read access" Some elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone: - **Teams** - **Players** - **Taxonomies** (in the Settings) Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ...4. Save the role.!!! info "Hierarchical permissions" Permissions are organized hierarchically by indentation: selecting a permission further to the right (e.g., Delete) will automatically enable the less-indented ones that precede it (e.g., Manage and Access).!!! tip "Bypass" If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.### Example : Crisis content creator!!! tip "Role : Crisis content creator"**Context:** This user is in charge of designing crisis management content. Their role is to create **scenarios** that can later be reused by other teams to run exercises. For example, they might build an **“Earthquake Crisis Scenario”**.**Capabilities:** - **Security platforms** : Manage groups to assign them grants - **Assessment** : Create scenarioWith this role, the user can design new scenarios, and configure everything needed to prepare exercises. For instance, they may create a **“Earthquake Crisis Template”**, which becomes the foundation for future simulations.Then, the user will be able to create scenario, launch it and grant their team on this simulation. ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---### Example : Local coordinator!!! tip "Role : Local coordinator" **Context:** This user is not a global content creator. Instead, they are trained locally to run a specific simulation designed by the content creator. They do not need all capabilities — only access to the resources explicitly granted to them.**Grants assigned through their group:** - **Simulation** → *Launch* on the simulation based on the “Earthquake Crisis”**Concrete workflow:** - The **Content Creator** travels to the **French Embassy** and trains a local coordinator. - This coordinator is granted launch to the simulation created from the *Earthquake Crisis Scenario*. - The coordinator can now run and manage this simulation, but cannot see or modify other simulations or scenarios. - Later, the same process is repeated at the **UK Embassy**, where another coordinator is granted launch only to the local simulation derived from the same scenario.---### Special Cases!!! tip "Simulations, Scenarios, and Atomic Testing" A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).!!! tip "Payloads" Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability. ---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.!!! warning "Default read access" Some elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone: - **Teams** - **Players** - **Taxonomies** (in the Settings) Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ...4. Save the role.!!! info "Hierarchical permissions" Permissions are organized hierarchically by indentation: selecting a permission further to the right (e.g., Delete) will automatically enable the less-indented ones that precede it (e.g., Manage and Access).!!! tip "Bypass" If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.### Example : Crisis content creator!!! tip "Role : Crisis content creator"**Context:** This user is in charge of designing crisis management content. Their role is to create **scenarios** that can later be reused by other teams to run exercises. For example, they might build an **“Earthquake Crisis Scenario”**.**Capabilities:** - **Security platforms** : Manage groups to assign them grants - **Assessment** : Create scenarioWith this role, the user can design new scenarios, and configure everything needed to prepare exercises. For instance, they may create a **“Earthquake Crisis Template”**, which becomes the foundation for future simulations.Then, the user will be able to create scenario, launch it and grant their team on this simulation. ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---### Example : Local coordinator!!! tip "Role : Local coordinator" **Context:** This user is not a global content creator. Instead, they are trained locally to run a specific simulation designed by the content creator. They do not need all capabilities — only access to the resources explicitly granted to them.**Grants assigned through their group:** - **Simulation** → *Launch* on the simulation based on the “Earthquake Crisis”**Concrete workflow:** - The **Content Creator** travels to the **French Embassy** and trains a local coordinator. - This coordinator is granted launch to the simulation created from the *Earthquake Crisis Scenario*. - The coordinator can now run and manage this simulation, but cannot see or modify other simulations or scenarios. - Later, the same process is repeated at the **UK Embassy**, where another coordinator is granted launch only to the local simulation derived from the same scenario.---### Special Cases!!! tip "Simulations, Scenarios, and Atomic Testing" A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).!!! tip "Payloads" Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability. ---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
Security platforms or Manage platform settings ?
I also realize that at this point, it’s the first time I come across the word assessments, and it isn’t connected to anything.
What is it for? I have no idea. Could be great to defined this capa OR write this Assessments (Scenarios, Simulation, Atomic Tesings). Something I can hold on to (on the application side as well).
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.!!! warning "Default read access" Some elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone: - **Teams** - **Players** - **Taxonomies** (in the Settings) Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ...4. Save the role.!!! info "Hierarchical permissions" Permissions are organized hierarchically by indentation: selecting a permission further to the right (e.g., Delete) will automatically enable the less-indented ones that precede it (e.g., Manage and Access).!!! tip "Bypass" If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.### Example : Crisis content creator!!! tip "Role : Crisis content creator"**Context:** This user is in charge of designing crisis management content. Their role is to create **scenarios** that can later be reused by other teams to run exercises. For example, they might build an **“Earthquake Crisis Scenario”**.**Capabilities:** - **Security platforms** : Manage groups to assign them grants - **Assessment** : Create scenarioWith this role, the user can design new scenarios, and configure everything needed to prepare exercises. For instance, they may create a **“Earthquake Crisis Template”**, which becomes the foundation for future simulations.Then, the user will be able to create scenario, launch it and grant their team on this simulation. ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---### Example : Local coordinator!!! tip "Role : Local coordinator" **Context:** This user is not a global content creator. Instead, they are trained locally to run a specific simulation designed by the content creator. They do not need all capabilities — only access to the resources explicitly granted to them.**Grants assigned through their group:** - **Simulation** → *Launch* on the simulation based on the “Earthquake Crisis”**Concrete workflow:** - The **Content Creator** travels to the **French Embassy** and trains a local coordinator. - This coordinator is granted launch to the simulation created from the *Earthquake Crisis Scenario*. - The coordinator can now run and manage this simulation, but cannot see or modify other simulations or scenarios. - Later, the same process is repeated at the **UK Embassy**, where another coordinator is granted launch only to the local simulation derived from the same scenario.---### Special Cases!!! tip "Simulations, Scenarios, and Atomic Testing" A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).!!! tip "Payloads" Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability. ---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
Note that the term exercise sometimes appears: it actually refers to our simulations.
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.!!! warning "Default read access" Some elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone: - **Teams** - **Players** - **Taxonomies** (in the Settings) Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ...4. Save the role.!!! info "Hierarchical permissions" Permissions are organized hierarchically by indentation: selecting a permission further to the right (e.g., Delete) will automatically enable the less-indented ones that precede it (e.g., Manage and Access).!!! tip "Bypass" If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.### Example : Crisis content creator!!! tip "Role : Crisis content creator"**Context:** This user is in charge of designing crisis management content. Their role is to create **scenarios** that can later be reused by other teams to run exercises. For example, they might build an **“Earthquake Crisis Scenario”**.**Capabilities:** - **Security platforms** : Manage groups to assign them grants - **Assessment** : Create scenarioWith this role, the user can design new scenarios, and configure everything needed to prepare exercises. For instance, they may create a **“Earthquake Crisis Template”**, which becomes the foundation for future simulations.Then, the user will be able to create scenario, launch it and grant their team on this simulation. ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---### Example : Local coordinator!!! tip "Role : Local coordinator" **Context:** This user is not a global content creator. Instead, they are trained locally to run a specific simulation designed by the content creator. They do not need all capabilities — only access to the resources explicitly granted to them.**Grants assigned through their group:** - **Simulation** → *Launch* on the simulation based on the “Earthquake Crisis”**Concrete workflow:** - The **Content Creator** travels to the **French Embassy** and trains a local coordinator. - This coordinator is granted launch to the simulation created from the *Earthquake Crisis Scenario*. - The coordinator can now run and manage this simulation, but cannot see or modify other simulations or scenarios. - Later, the same process is repeated at the **UK Embassy**, where another coordinator is granted launch only to the local simulation derived from the same scenario.---### Special Cases!!! tip "Simulations, Scenarios, and Atomic Testing" A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).!!! tip "Payloads" Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability. ---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
We give an example on grant here
Then, the user will be able to create scenario, launch it and grant their team on this simulation.
But we defined the grant later.
I like the teasing !
docs/administration/rbac.md
Outdated
| @@ -0,0 +1 @@ | |||
| # User permissions ## What is RBACRole-Based Access Control (RBAC) is the way OpenAEV manages who can do what inside the platform. Each user belongs to a group, and this group has one or more roles that define its **permissions**.Permissions determine what features a user can access. If a user does not have the right permission, the option will simply not be available to them.In addition to general permissions (called *capabilities*), OpenAEV also supports **grants**. Grants are more precise: they allow access to a specific resource, such as one particular simulation, without giving the user access to all simulations.!!! warning "Default read access" Some elements in OpenAEV are always visible to all users, regardless of their assigned capabilities or grants. By default, the following features are open for everyone: - **Teams** - **Players** - **Taxonomies** (in the Settings) Users can view these elements without needing any specific capability, but additional rights are required if they want to manage them.---## How to create a roleTo create a new role in OpenAEV:1. Go to **Settings → Security → Roles**.2. Click on **Create role**. Enter a **name** and an optional **description** for the role3. Select the **capabilities** that should be included in this role, such as: - Access assets - Manage dashboards - Delete documents - ...4. Save the role.!!! info "Hierarchical permissions" Permissions are organized hierarchically by indentation: selecting a permission further to the right (e.g., Delete) will automatically enable the less-indented ones that precede it (e.g., Manage and Access).!!! tip "Bypass" If you want a user to automatically have all capabilities without restriction, you can enable the **Bypass** capability in their role.Once the role is created, it can be assigned to a **group**. All users in that group will automatically inherit the role’s permissions.### Example : Crisis content creator!!! tip "Role : Crisis content creator"**Context:** This user is in charge of designing crisis management content. Their role is to create **scenarios** that can later be reused by other teams to run exercises. For example, they might build an **“Earthquake Crisis Scenario”**.**Capabilities:** - **Security platforms** : Manage groups to assign them grants - **Assessment** : Create scenarioWith this role, the user can design new scenarios, and configure everything needed to prepare exercises. For instance, they may create a **“Earthquake Crisis Template”**, which becomes the foundation for future simulations.Then, the user will be able to create scenario, launch it and grant their team on this simulation. ---## Grants### How to grant a simulation to a userBeyond global **capabilities** defined in roles, OpenAEV also allows assigning more precise **grants**. Grants define permissions on specific resources (for example, one simulation), and they are always managed at the **group** level.**To grant a simulation to a user:**1. Go to **Settings → Security → Groups**.2. Click on **Manage grants** in the group options.3. A drawer will open with the available resources: - Simulations - Scenarios - Atomic testings - Payloads4. Select the specific items you want the group to access and assign the appropriate grant level. ---### Types of GrantsThere are three levels of granularity:| Grant | Rights included ||---------|-------------------------------------------|| Access | View only || Manage | View, edit, delete || Launch | Manage rights + ability to launch tests |---### Example : Local coordinator!!! tip "Role : Local coordinator" **Context:** This user is not a global content creator. Instead, they are trained locally to run a specific simulation designed by the content creator. They do not need all capabilities — only access to the resources explicitly granted to them.**Grants assigned through their group:** - **Simulation** → *Launch* on the simulation based on the “Earthquake Crisis”**Concrete workflow:** - The **Content Creator** travels to the **French Embassy** and trains a local coordinator. - This coordinator is granted launch to the simulation created from the *Earthquake Crisis Scenario*. - The coordinator can now run and manage this simulation, but cannot see or modify other simulations or scenarios. - Later, the same process is repeated at the **UK Embassy**, where another coordinator is granted launch only to the local simulation derived from the same scenario.---### Special Cases!!! tip "Simulations, Scenarios, and Atomic Testing" A user can access these either through specific **grants**, or globally if the group has the **ASSESSMENT** capability (which overrides individual grants).!!! tip "Payloads" Access is given either through specific **grants**, or globally if the group has the **PAYLOAD** capability. ---## Capability DependenciesIn some cases, performing an action in OpenAEV requires more than one capability. If a required capability is missing, the action will be blocked and a warning message will explain which capability is missing.### Example- In **Scenarios**, when creating an article, the user also needs the capability to **access Channels**.- If the user does not have this capability, the article cannot be created.- A warning will be displayed, indicating that the necessary capability is missing. This mechanism ensures consistency across the platform: actions that depend on other features cannot be performed without the proper access. | |||
There was a problem hiding this comment.
We are talking of 4 grantable ressources and we have 5 grantable ressources on the screenshot
heditar
approved these changes
Sep 15, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes
Related issues