Assign permissions to a role
Use Assign permissions to set the complete permission membership of one role. The change affects every user holding that role.
Steps
- Open Authorization → Assign permissions.
- Find the intended role and inspect its current grants.
- Open its permitted assignment action.
- Wait for catalogue loading and original-grant resolution to finish.
- Search by permission code; read Name and availability for selection reasons.
- Keep every grant that should remain and select only approved additions.
- Review the selected count across all catalogue pages.
- Choose Assign, reopen and verify the final membership.
- Have affected staff sign in again and verify the intended workflow.
Delegation decision table
| Proposed addition | Expected rule |
|---|---|
| Ordinary permission actor already holds | May be delegated with required operation/target authority |
Ordinary permission actor lacks, approved tenantGrantable, actor holds delegation authority | May be delegated with required operation/target authority |
| Missing permission without eligible bounded delegation | Refused |
| Reserved platform/admin/catalogue-write/delegation power | Cannot be newly delegated through tenant APIs |
| Existing grant retained unchanged | Preservation is considered separately; target protection still applies |
Example: Add receipt allocation to a role that already permits receipt viewing and posting. The final selection must retain viewing and posting as well as allocation. Selecting allocation alone removes the other two grants.
Loading and protection
The dialog prevents saving while originals are unresolved or the catalogue failed to load. Use Retry; do not interpret a loading error as “no permissions assigned”. Some existing non-addable grants can be retained but cannot be freely re-added after removal. Preserve the reviewed set and escalate uncertainty before saving.
ADMIN grant changes require role.update, admin.update and tenant.permission.grant; its identity cannot be renamed. SUPER_ADMIN and owner/platform-bearing roles are protected from tenant editing. The backend checks these rules even if the actor holds general role-update authority.
Enabling a module, assigning a role and assigning units remain separate tasks. Successful grant assignment does not prove the tenant is ready to post financial documents.