Roles and permissions
Who can do what, decided by role rather than by person.
The model
- System roles — SuperAdmin and Workspace Administrator — are fixed by the product and cannot be edited.
- Functional roles are editable templates: Product Owner, Scrum Master, Tech Lead, Developer, QA, Release Manager, Committee Approver, Stakeholder, Auditor.
- Permissions are granular actions on a resource, granted to a role and never to an individual.
- Administering the system and governing the work are deliberately separate: a project manager cannot grant themselves permissions.
Roles for change control
- “Aprobador de Comité” authorizes deployments, and gives the Level 1 authorization for data changes.
- “Analista Datos” and “Administrador de Datos” keep writing a data change apart from authorizing it.
Plans
A workspace's plan can limit which work-item types and which sections are available. A permission never opens something the plan does not include.