Assigning workspace roles
01In a nutshell #sec_4661e80a
A workspace role is an assignment to a person or a group, in a directory that authenticates, for a duration that is displayed and chosen — it is never assumed.
02Where #sec_41d439a2
Security & access › Roles. All assignments of all workspaces, filterable by holder, role or workspace, by Users or Groups. The footer counts: N assignments · N users, N groups, and N expired.
The workspace wizard refers to it from its Roles step: assignment, expiration and suspension live there, with their own guards.
03The doctrine, before the act #sec_adb036d2
The screen names it the doctrine of traced cycles: No "permanent": all assignments expire within a maximum of 12 months, and are explicitly renewed. The duration is displayed and chosen — it is never assumed.
A nuance, written in the expiration panel: a person always has a deadline (12 months at most); only a group can be without term. And when a group is, the list marks it as Permanent · to be re-examined in review — a signaled debt, not a comfort.
04Assign: New role #sec_58174df5
The panel asks, in order:
The workspace and the role. The Manager role is the one that governs: without it, no one governs this workspace, and the wizard refuses to create. The other roles — auditor, designated reviewer — are assigned in the same way.
The directory where to search. Only directories that authenticate are proposed. The reason is written: a holder taken from a directory that REVIEWIT merely collects cannot open the product — the authorization would appear active, and would still be counted as a license. Collecting a directory and authenticating to it are two different things; roles are assigned to the second.
The holder. Search for a person or a group from the directory… The search only returns what exists in the directories that authenticate. The holder does not need to have already connected: their account is created with their first session.
The deadline. At most twelve months for a person. Choose short for a mission (an external auditor: the duration of the mission) and twelve months for an on-site manager, knowing that you will return.
05Read the list #sec_eafdbf2c
Each line bears the holder — for a group, Security Group · N member(s), and the freshness of its composition: reported ago … or never reported — the role, the workspace, the status, and the deadline: in N d, since N d (expired), or Permanent.
A group never reported has unknown members: the assignment exists, but nobody knows who it opens to. Launch a directory collection.
06Manage expiration #sec_642fbf5c
Select one or more lines, Manage expiration . The deadline moves; it does not disappear for a person. Deadline updated.
An expired assignment no longer confers anything, even if it is still displayed in the database until the suspension pass. The Roles and authorizations report of the workspace counts it as expired, still active — and the list here counts it in N expired(s).
07Suspend, reactivate, revoke #sec_3dcca040
Three gestures on a selection, three dialogs:
| Gesture | What the screen says |
|---|---|
| Suspend | Holders will lose access until reactivation. |
| Reactivate | Role reactivation can only be done if the expiration date is valid. An expired assignment is re-granted, it is not reactivated. |
| Revoke | Holders will lose access immediately. The act is traced in the audit log. |
Suspend for an absence; revoke for a departure. In both cases, the trace remains.
08The two lists that expire #sec_8bb26392
The Maintain the subscription page said it: the list of roles is the one that expires the most discreetly . Two checks, twice a year:
- Does each workspace have a Manager whose assignment holds? A workspace without
a live role cannot be reactivated, and does not launch anything.
- Is each holder still there? Match the list of your departures. A role
expired purges itself; a role eleven months old placed on a departed person does not purge until eleven months.
09What is not done here #sec_2cdbf751
Subscription administrators are another list, another page — Security & access › Administrators — and another doctrine: never a group, always a person. The administrators page deals with them.
And delegations of review authority between reviewers are not roles: they are set in the Workspace Center, by the workspace manager.
10To remember #sec_5ae348a5
A directory that authenticates, a person or a group, a deadline within twelve months. Nothing permanent except a group, and even then, marked as debt. What you assign here opens the Workspace Center; what you let expire closes it by itself.