Madame Illa has four kinds of people in her hardware store: sellers who prepare orders, cashiers who take the money, a storekeeper who counts stock, and herself. She does not want the seller to close a register, or the storekeeper to see the day’s takings. She needs a way to say once what each kind of person can do, and to reuse it for the next person she hires. The same steps apply to any business that wants different people to see and do different things.

​
How access is built

Exowpee builds access in three layers.
  • A permission is one thing a person may do, such as listing orders or creating a role.
  • A role is a named set of permissions, for example “cashier”.
  • A profile is a named set of roles. People are given profiles, as described in Assign access to people.
Every new company and client account starts with two built-in profiles: administrator and read only. Built-in profiles and roles cannot be changed. Everything else is yours to build.

​
See what is available

Before building a role, Madame Illa opens List available permissions. Each permission group has a title and a description. If she wonders what her company as a whole is allowed to use, List my company permissions shows the permissions that its own roles grant to the company.

​
Build the roles

She creates a role “cashier” with Create a role, and ticks the permissions a cashier needs. List roles and View a role show what exists. Later she changes the permissions with Edit a role, and a role she no longer needs goes away with Delete a role.

​
Bundle the roles into profiles

A person usually needs several roles, so she creates the profile “shop assistant” with Create a company profile from the roles “seller” and “cashier”. She finds the profiles again with List company profiles and View a company profile, changes their name or roles with Edit a company profile and removes one with Delete a company profile.

​
Who works where

Madame Illa works in her company. At Groupe Gbaguidi, Sèdjro Gbaguidi defines the roles and profiles of the organization in the same way, and a firm such as Cabinet Hounkpatin defines those of each client account. Each space has its own roles and profiles, and its own list of permissions. The rules name the differences.

​
The rules

  • Role and profile names are lower-cased before they are checked. A role name has at most 255 characters and is unique among the roles of the space. A profile name has at most 120 characters and is unique among the profiles of the space. The name of a deleted role or profile can be used again.
  • A role description has at most 255 characters and a profile description at most 120.
  • Permissions are chosen by their group identifier, without duplicates. A role created without permissions is allowed. Sending a list when editing a role replaces all its permissions, and an empty list removes them all.
  • A profile needs at least one role. Only custom roles can be put in a profile: built-in roles are refused. Sending roles when editing a profile replaces the previous ones.
  • Built-in roles and built-in profiles cannot be edited or deleted.
  • Deleting a role does not check whether profiles still use it. It is removed and every profile loses it.
  • A profile cannot be deleted while a member or an agent account is assigned to it. Deleting it removes it and detaches its roles.
  • Roles are listed once per role, filterable by name and by built-in status, sorted by id, name or creation date (and update date in the company and client spaces), with at most 1,000 per page, or 100 in the organization space.
  • Company, client and organization spaces have their own versions of these actions, for example List available client permissions and Create an organization role. The list of permissions depends on the space: each one only offers the permissions that exist there.

​
All the actions of this topic