Security and roles

The Security studio

Roles, groups, direct assignments, access rules and an effective-access inspector are all managed from one tabbed surface: Admin → Users & Security → Roles, Groups & ACLs. Its tabs are:

• Roles — define roles and which other roles each one contains (inherits).
• Groups — define assignment groups and the roles granted to every member.
• Assignments — grant roles directly to a user, or add a user to a group.
• ACLs — the access control rules that gate read/write/create/delete per table (and per field).
• Effective access — pick a user (or an ad-hoc role) and see their resolved role set plus a full read/write/create/delete matrix, computed by the same evaluator the app itself uses.

Role inheritance

Holding a role implies holding every role it contains, transitively. That closure is what access rules evaluate against — it’s why the admin role, which contains nearly every other delivered role, passes almost every access check.

Roles

Role	Label	Description
snc_internal	Internal (authenticated)	Baseline role for any authenticated internal user. RezolveApp adds it to ACLs left without a role so an authenticated-but-unprivileged user can still be matched.
snc_external	External (portal customer)	Baseline role for external/customer portal users. A user holds snc_internal OR snc_external, never both.
security_admin	Security administrator	High-security role required to edit Access Controls. Requires an explicit ‘Elevate role’ action each session (admin_overrides + ACL authoring).
admin	System Administrator	Contains nearly every delivered role. An admin therefore satisfies the role check on almost all ACLs (subject to admin_overrides).
itil	ITIL (fulfiller)	Core fulfiller role: read/write Task-derived records (incident, problem, change, request) within assignment scope.
itil_admin	ITIL administrator	Elevated ITIL: manage the IT Service Management process configuration. Contains itil.
change_manager	Change manager	Approve and manage change requests / CAB. Contains itil.
problem_manager	Problem manager	Own and manage problem records and known errors. Contains itil.
ra_incident_write	Incident write	Granular write access to incidents (a delegated subset of itil).
ra_customerservice_agent	Customer service agent	Work customer-service cases. Contains snc_internal.
ra_customerservice_manager	Customer service manager	Manage Customer Service agents and case configuration. Contains the agent role.
knowledge	Knowledge contributor	Author and edit knowledge articles. Contains snc_internal.
knowledge_manager	Knowledge manager / Approver	KB owner / approver: approves & publishes, rejects, retires and republishes articles. Distinct from the author role. Contains knowledge.
knowledge_admin	Knowledge administrator	Manage knowledge bases and workflows. Contains knowledge_manager.
catalog	Catalog editor	Build and edit catalog items / intake forms.
catalog_admin	Catalog administrator	Administer the service catalog. Contains catalog.
approver_user	Approver	May act on approval records assigned to them (sysapproval_approver). Held by most fulfillers.
user_admin	User administrator	Manage users, groups and role assignments (sys_user / sys_user_group).
report_admin	Report administrator	Create and share reports and dashboards.
personalize_dictionary	Personalize dictionary	Edit the data dictionary (sys_dictionary) — a builder-tier role.
ra_hr_core.basic	HR basic	Baseline HR access — open HR cases as an employee, see only your own. Contains snc_internal.
ra_hr_core.case_writer	HR case writer (agent)	HR agent — read/write HR cases and tasks. Contains the basic role.
ra_hr_core.manager	HR manager	Manage HR cases and the HR team. Contains the case-writer role.
ra_hr_core.admin	HR administrator	Administer HR Service Management configuration. Contains the manager role.
ra_spm.portfolio_user	Portfolio user	View and contribute to portfolios, demands and goals.
ra_spm.portfolio_manager	Portfolio manager	Manage portfolios, demands, programs and resource plans.
ra_spm.admin	Enterprise Portfolio Management administrator	Administer Enterprise Portfolio Management configuration.
procurement_user	Procurement user	Raise and track purchase requests / requisitions.
sourcing_analyst	Sourcing analyst	Run sourcing events and evaluate suppliers. Contains procurement_user.
procurement_admin	Procurement administrator	Administer Source-to-Pay (catalogs, suppliers, contracts).

Groups

Groups grant a fixed set of roles to every member. Out of the box, groups include Service Desk, Network, Change Management, Problem Management, Customer Support, HR Operations, PMO / Portfolio Office, Procurement, and Knowledge Authors — each mapped to the roles its members need. Adding a user to a group is a quick way to grant several roles at once, and to keep that grant tied to the team the user belongs to rather than to the individual.

Assigning roles

Use the Assignments tab to:

1. Grant a role directly to a specific user, or
2. Add a user to a group (which grants that group’s roles to them).

Direct grants and group membership can be combined — a user’s effective roles are the union of both, plus everything those roles contain.

Access Control (ACL) rules

Access rules live on the ACLs tab (and the standalone Access Control (ACL) Rules editor under Admin → Users & Security). Each rule targets a table — or a specific field on a table — for one operation (read, write, create, delete), optionally requires one or more roles, and can carry a row-level condition (for example, restricting read access to records a user opened or is assigned to). Rules can be marked active/inactive, and admin bypass is on by default for each rule.

Checking effective access

Before relying on a role or rule change, open the Effective access tab, pick a real user or an ad-hoc role, and review the resulting read/write/create/delete matrix per table. You can also impersonate that subject to walk the live app as them, which is the fastest way to confirm a permission change behaves as intended.

Admin gating

The Admin area itself is reached from the app’s navigation rail; the modules inside it — tables, forms, security, branding, notifications and the rest — are intended for users holding the admin role (or a role it contains). security_admin is called out separately because editing access rules is treated as an elevated action.