Understanding User Groups and Permissions
Every user's access comes from the user groups they belong to. This article explains how groups, permissions, and access rules combine to control who can see and do what.
Roles are not assigned to individual users. Instead, you add each user to one or more user groups, and every group provides two things:
- Access Rules: Optional conditions that narrow which records permissions apply to.
- Permissions: The actions that members of the group can take, per record type. View, create, edit, and delete for Employees, Jobs, Tasks, Placements, Employers, and Clients, plus admin-level areas like Forms and Policies.
Default User Groups
There are two default user groups that are accessible within the Onboarding Portal:
- Admins: Contains every permission including the ability to manage Forms, Policies, User Groups, Custom Views, and API Tokens.
- Members: Contains permissions that allow the ability to view, create, edit, and delete record types including Employees, Jobs, Tasks, Placements, Employers, and Clients.
User Groups can be accessed via Settings > Organization > User Management > Groups:
*Note* The default user groups do not start with access rules, meaning that users will be able to see all records for the records they're granted. You can edit both default groups, or create your own with separate access rules.
Creating a User Group
Begin by selecting the "Create Group" option at the top right:
Within the "Create a new user group" window, enter a name for the User Group and then select the appropriate "Access Rules" and "Permissions".
*Note* For example, a company staffs light-industrial jobs across two regions and wants Regional Coordinators to manage candidates without the ability to delete records.
The Administrator creates a User Group titled "Central Coordinators" with the permissions "View Employees", "Edit Employees", "View Tasks", and "Edit Tasks", and one Access Rule of "employee.custom_attributes.region is Central". Regional Coordinators in that User Group can update candidate records and work onboarding tasks for the Central region. They are unable to delete records, see the other region's candidates, nor modify Forms or Policies.
In the event those same Regional Coordinators are needing administrative access, there is no need for the User Group to be modified. Instead, they will be added to the default "Admins" User Group, granting them all the necessary permissions.
Access rules
Access rules are conditions evaluated against each record.
For example, an access rule of "employee.custom_attributes.tempworks_branch_name is Minneapolis" means that a user group with that access rule and the "View Employees" permission will only see candidates whose are within the "Minneapolis" branch:
*Note* Rules can only reference properties marked as a "Permission Scope". If a property you expect isn't available in the rule builder, you will need to enable the "Permission Scope" for that custom attribute.
Navigate to Settings > Organization > Custom Attributes:
Search for the custom attribute and once found and select "Edit":
Select the checkbox to enable the Permission Scope, and select "Update Custom Attribute":
Once updated, the rule can be enabled within the creation of the user group.
*Note* Granting a permission without any access rules for that entity will result in users having access to all records of that type. If a group is meant to see only specific records, ensure that rules are created for those entities.
Permissions
Each permission pairs a record type with an action. Examples include:
- View Employees
- Edit Employees
- Create Jobs
- Delete Tasks
- Etc.
*Note* Edit, create, and delete permissions each depend on the matching view permission. For example, you are unable to grant the "Edit Employees" permission to a group that doesn't also have the "View Employees" permission.
The following permissions are able to be selected when creating/editing a user group:
- View/Edit/Create/Delete
- Employees
- Jobs
- Placements
- Tasks
- Employers
- Clients
- Custom Views
- Policies
- Forms
- User Groups
- API Tokens
Once you have selected the permissions intended for the user group, you can now add or invite users:
Once the users have been added, select "Create User Group" to complete the setup:
With the User Group created, should you have the necessary permissions, you can then either "Edit" or "Delete" the User Group via their respective options within the "User Group" page:
