The Authorization Model
Three duties per business object (View, Edit, Process), object roles and add-on bundles, licensing and roles both checked, and what a refused user sees.
Draft brief for authors. Replace with the final text; keep the concept-page structure.
Page type: Concept · Audience: Administrator
Contains
- One role per business object and duty (Equipment Viewer, Equipment Partner Editor, Maintenance Task List Operation Processor, …); an Editor includes View, a Processor includes View; nothing is inherited within a family.
- The add-on bundles (Asset Management Viewer / Editor / Processor) as every object of the add-on.
- Licensing (add-on) and roles are always both checked; fail closed.
- What a refused user sees: the sentence naming the role and the collection that would grant the action; tiles, tabs and lists follow the roles.
- Who may stop or pause a job: the same duties per object.
Related information: role-collections, custom-role-collections, messages-authorization.
Source in the product repository: customer guide §4, .claude/rules/licensing-and-roles.md (D108, D139).
Last updated: