Sugar Community Edition Installation and ... - SugarForge

UsersCreating RolesWhen you create a role, you specify whether access is permitted or not, the modulesthat the role can access, the access type such as Normal (for regular Sugar users) oradministrator, and the actions that they can perform.• Access options are as follows:Enabled: permits the user to view the module.Disabled: hides the module from the user’s view.Not Set: leaves the setting unchanged.• Privileges are as follows:Delete: Delete records in the module. If None is selected, the Delete button isdisabled on the detail page.Edit: Users can edit records in the module. If None is selected, the Edit buttonis disabled on the detail page. Additionally, the user cannot use the MassUpdate panel to update records for the module.Export: Export record data in the module. The Export link located at the top ofList Views is removed when this privilege is not available to the user.Import: Import record data in the module. The Import link in the navigationbar does not appear when this privilege is not available. List: Users can view list of records in the module or in a sub-panel but cannotedit them. Users are unable to access the module's list view when thisprivilege is not available. View: Users can view the detail page of records in the module.Action options are as follows:• All: all users who are assigned to the role can perform the action.• Owner: Only the user who is assigned to the record can perform theaction. If there is no assigned user, then the user who created the recordcan perform the action.• None: prevents all users assigned to the role from performing the action.• Not Set: leaves the setting unchanged.When a user is assigned multiple roles, the roles definitions are merged and the morerestrictive settings prevail. For example, if a user is assigned to two roles pertaining toone module where one role grants administrator access and the other grants end-useraccess, then user has only end-user access. In this case, the end-user access overridesthe role with the administrative access because it is more restrictive.A special case is the “Not Set” value in a role definition. You can use “Not Set” toensure that a role does not affect a particular setting. This allows simple roles to beconstructed and then combined to achieve the desired security level.For example, if users are assigned to both the following roles:Role A, where Access Type = Admin and Export (action) = NoneRole B, where Access Type = Normal and Export (action) = AllThen, users can only see records that are assigned to them. But they cannot export thedata.Sugar Community Edition Installation and Administration Guide53