Design Notes
Roles & Permissions manages who can use system functions, form resources, and form record data.
Use this page when administrators need to create roles, assign roles to people or structures, configure feature access, configure form resources, and diagnose permission decisions.
Open Roles & Permissions
Open System > Roles.
Page Structure
| Area | Purpose |
|---|---|
| Role List | Searches, creates, selects, enables, disables, and deletes roles |
| Role Details | Shows binding count, permission count, built-in status, role status, and description |
| Role Assignments | Assigns the selected role to members, departments, or organizations |
| Feature Permissions | Controls menus, pages, and operations |
| Resource Permissions | Controls forms, buttons, fields, and related resource permissions |
| Condition Sharing | Creates conditional record-sharing rules outside a single role |
| Permission Query | Checks the effective roles and record permissions for a subject |
How Permissions Work
Roles & Permissions has three layers:
| Layer | Description |
|---|---|
| Role Model | Defines the role code, name, status, and description |
| Role Assignments | Grants the role to members, departments, or organizations, optionally within a time window |
| Permission Configuration | Defines what the role allows or denies through feature permissions, resource permissions, data policies, and field permissions |
The subject must have an effective role assignment before the role permissions can take effect.
Built-In And Custom Roles
The built-in Space Admin role has full tenant-side control permission.
Custom roles are tenant-defined roles used for business teams, job responsibilities, and operational scopes.
Entry Permission And Data Permission
Entry permission and data permission are different.
A user may match a data policy for a record, but still cannot see the record from the form page when the form is not visible or the view button is not allowed.
Check both resource permissions and data policies when diagnosing access issues.
Common Workflow
- Create a role
- Assign the role to members, departments, or organizations
- Configure feature permissions
- Configure resource permissions for forms, buttons, and fields
- Configure data policies for record-level access
- Use Permission Query to verify the final result