Security roles and permissions
Access in iGrafx Process360 LiveProcess360 Live iGrafx's cloud platform for end-to-end process management — combining process design, mining, simulation, and automation in a single environment. is controlled by security roles — named bundles of permissions that you assign to users and groups. Three kinds of roles cover the three levels where access decisions happen: the server, each repository, and each item.
Overview
A role pairs each permission with one of three states: Grant, Veto, or neither. When the platform checks whether a user may do something, it combines every role the user holds at that level — directly and through groups:
- Rights are additive: a grant from any role is enough.
- Veto wins: if any role vetoes the permission, the user doesn't have it, no matter what other roles grant.
- No grant anywhere means no permission.
Key concepts
- Server roles control what a user can do across the whole installation — starting with Use Application, the permission to reach the product at all, and extending to administering it: managing users and directories, editing server settings, managing roles and licenses, customizing themes and logos, and reaching the REST API. Assigned to users and groups platform-wide.
- Repository roles control repository-wide abilities — using the repository, managing its configuration areas, bulk approvals. Assigned per repository, or on all repositories at once.
- Item roles grant and deny abilities on repository items — view, modify, print, cycle participation. A role defined once is available in all repositories; it's assigned on an item's Permissions tab and inherited by everything beneath that item, marked [Inherited], until a closer assignment overrides it.
- Administrative owner — every item has an administrative owner, who holds Set Any Item Permissions on that item regardless of the roles they hold. New items go to their creator by default, but a repository can nominate a specific user instead — see Set the default administrative owner. This is an access-control concept, and separate from the process owner named on a diagram, which grants no permissions. The effective permissions view shows administrative ownership as its own column.
- License gating — a permission only works when the user's license also covers the activityActivity A named step in a process (e.g. "Approve Invoice"). Each event in an event log records one activity occurrence for one case.; see the License capability matrix.
The permissions reference lists every permission at each level and the built-in roles; Assign security roles covers the mechanics.