Roles, permissions and scopes

Permissions, not job titles

Every action in the system asks for a permission: recording time asks for one, approving a document for another, posting a journal for a third. The system never asks whether someone is a partner. It asks whether they hold the permission, which means the firm, not the software, decides what each person may do.

A role is a named set of permissions. The firm starts with eleven, from managing partner down to receptionist, and changes them as it sees fit. A person can hold more than one role, and what they may do is everything their roles grant together.

Scopes

Many permissions are granted at a scope, which says whose records the permission reaches:

So an associate may hold Record time at own scope, while the head of litigation holds See recorded time at practice area scope.

Office and practice area sit side by side: neither reaches what the other does. Someone granted a permission at both reaches both. A confidential matter is reached by neither, only by its team and by people who hold the permission for the whole firm.

A firm with branches can give each branch's head the Head of office role. It does a partner's work and, for the office the person works from, reads its people's leave and standing, decides their leave, approves their timesheets and reads the client money of its matters. Move the person to another office and the role follows them there.

Reading and changing a role

A role's page says at the top how many permissions there are, how many the role holds and how many at the firm-wide scope. Its permissions are grouped by domain, each saying how many of its permissions the role holds and the widest scope among them; open a domain to see its permissions with their ticks and scopes. Search the permissions as you type, and narrow them to those granted, those not granted, or, while you are changing the role, those changed.

• Grant or remove a whole domain at once. You can only where you hold every permission in it yourself.
• Grants from another role. A role that does another's work holds that role's permissions too; they read From that role and are changed there.
• Compare with another role to see its grants beside this one's, each difference marked: only here, only there, or a different scope.
• Review changes lists every change by domain, added, removed, scope widened or narrowed, before anything is saved, and the audit trail records exactly that list.

Rules that always hold

• The managing partner holds every permission.
• Nobody may grant a permission they do not hold themselves, or at a wider scope than they hold it. Someone holding a permission at office scope cannot grant it at practice area scope, or the other way round.
• An ethical wall overrides every permission, the managing partner's included.
• The firm administrator role cannot lose the management of people and roles, and the managing partner role cannot lose the emergency override, so the firm can never lock itself out.
• A role that people still hold cannot be deleted; move them to another role first, or deactivate it.