Worked administration examples

These examples use invented Bright Home Supplies data. Adapt permission selection to the exact operations documented by each business module. They are recommended practice exercises, not seeded role templates.

1. Onboard Farah for North receipts

Request: Farah should record, post and allocate customer receipts at North, without South access.

1. Verify Payments and dependencies are entitled and available.
2. Create/review a Customer Receipts job role with the required payment operations and customer/invoice discovery.
3. Create farah.accounts with the approved email and enabled state.
4. Assign the reviewed role while retaining any other approved role memberships.
5. In User business unit access select North only and choose North as primary.
6. Have Farah sign in freshly and test an approved North workflow.
7. Confirm a South operation is refused.

Expected: Farah has the intended receipt operations at North. Recovery: If North entry works but posting fails, inspect the posting permission and domain setup; do not grant South or administrator access as a workaround.

2. Add one role without losing two others

Omar already holds Sales Viewer and Stock Viewer. Add Sales Preparation using Assign roles. Keep all three selected across catalogue pages before choosing Assign. Reopen and verify all three.

Expected: Existing approved viewing survives. Recovery: If an original role is unresolved, cancel/retry loading instead of saving a shortened set. If a mistaken replacement was saved, use a fresh read and an approved corrective replacement.

3. Add a missing permission through bounded delegation

Ali cannot add an ordinary permission he does not hold. Sara reviews the exact catalogue code and its approved delegation eligibility, then uses her delegation authority plus required role/administrator-update authorities for the target.

1. Load the complete original permission set.
2. Retain its intended grants and add the approved permission.
3. Save and verify the target role.
4. Have its members sign in again.

Expected: Role members receive the grant. Sara does not automatically acquire permission to execute the operation herself. Recovery: If the permission is reserved or not eligible, use operator/release review rather than copying an owner role.

4. Move Nadia from North to South

Review whether Nadia's job permissions change. If duties are unchanged, avoid changing the shared role unnecessarily. Select South, clear North where no longer authorised and make South primary; save and reload.

Expected: South is the saved primary and North is no longer selected. Recovery: A failed multi-request save can be partial. Reload actual saved decisions and fix the remaining difference before declaring the move complete.

5. Prepare a future feature rollout

Ali sets an approved feature Enabled with a future Effective from and the correct displayed browser zone. He preserves the existing advanced configuration.

Expected: Configured enabled can be Yes while Available now remains No before the start. Recovery: At rollout time refresh, then check entitlement and dependencies if it remains unavailable. Do not erase the dates simply to turn all indicators to Yes.

6. Publish and roll back appearance

Ali changes Bright Home Supplies to the Trading colour scheme, previews locally and saves the draft. After approval, he publishes the saved draft. Later the team requests the earlier style.

1. Open publication history.
2. Restore the earlier publication to draft.
3. Inspect the restored draft.
4. Publish it again.

Expected: Preview is local; publication affects the tenant. Restoration alone does not publish.

7. Recover a locked owner

Sara cannot sign in and no authorised tenant administrator can unlock her. A platform OPERATOR verifies the requester, selects the correct tenant/account and issues recovery with a reason. Sara uses the newest private link within 30 minutes and then signs in normally.

Expected: Password setup unlocks the account and invalidates old sessions/links. Recovery: An expired/superseded link needs a new issuance; an ordinarily disabled or suspended target is not fixed by password recovery alone.

8. Replace the owner

An approved ownership transfer replaces Sara with a new verified owner. The operator selects Sara's owner account, enters the replacement identity and reason, submits replacement and separately issues the invitation.

Expected: The previous owner is disabled immediately; the new owner remains disabled until setup. Recovery: If the invitation expires, the operator issues another link. Do not try to reactivate the old owner through tenant Users as an improvised transfer reversal.

9. Diagnose “enabled but missing”

Payments shows Configured enabled Yes. Farah still cannot see/use the workflow. Check runtime availability, entitlement, dates and dependencies, then her role grants, fresh session, unit access and payment-specific setup.

Expected: The missing layer is corrected precisely. Adding SUPER_ADMIN is not a diagnostic step.

10. Offboard without deleting history

Disable an ordinary departing account through its allowed update action, hand over outstanding work and record the approved change. Review scope through supported procedures; the current unit screen cannot save zero selected units.

Expected: Login access is addressed while business history remains available according to normal rules. Recovery: Use operator replacement for a protected owner; do not assume ordinary account editing applies.

11. Remove posting while preserving other duties

Request: Farah may enter receipts but must no longer post them. First check every role she holds: removing a permission from one role will not remove access supplied by another role.

Role	Before	Intended after
Receipt Preparation	payment.view, payment.create	Keep both
Receipt Posting	payment.view, payment.post	Remove this role from Farah if no longer approved
Stock Viewer	Approved inventory viewing permissions	Keep unchanged

1. Read Farah's complete role membership and each role's grants.
2. Determine whether another retained role supplies payment.post.
3. In Assign roles, keep Receipt Preparation and Stock Viewer; clear Receipt Posting.
4. Save the complete intended set, reload and verify.
5. Have Farah sign in again. Confirm permitted preparation works and posting is refused.

Expected: Preparation survives and posting is unavailable. Recovery: If posting remains available, inspect overlapping grants before changing a shared role that other staff still need. These example roles are not shipped templates.

12. A non-grantable permission the actor already holds

Request: Ali must give an ordinary role a non-reserved permission he already holds, but its Tenant grantable value is No.

1. Confirm the permission is ordinary, already held by Ali and appropriate for the job.
2. Confirm Ali has the role-update authority and the target is editable.
3. Retain the role's original grants and add the approved permission.
4. Save and verify with a fresh member sign-in.

Expected: Tenant grantable No does not by itself prohibit delegation of an ordinary permission already held. Recovery: If the permission is reserved or the role protected, the other checks still refuse the change. The flag only controls the additional bounded delegation route for missing permissions.

13. Reject an attempted owner-role copy

Request: Give a new manager the same authority as the owner by assigning SUPER_ADMIN.

Use Protected accounts to explain the boundary. Tenant role assignment cannot create or remove owner membership. Record the requested business duties and assign approved operational roles where appropriate. If ownership truly changes, use the verified operator replacement procedure.

Expected: No improvised owner copy is created. Recovery: A disabled checkbox or server refusal is not solved by renaming a role or copying reserved permissions into a custom role.

14. Recover from a partially saved branch move

Request: Move Nadia to South. A save error appears after some unit requests have succeeded.

Observed after reload	Meaning	Corrective action
North denied, South not yet primary	Earlier decisions saved; primary promotion may not have run	Select the approved final units and South primary, then save and reload
South primary, North still allowed	Final scope still exceeds the approved request	Clear North and resave the intended set
The access list itself failed to load	Actual state is unknown	Retry loading before submitting corrective changes

Expected: Completion is based on the reloaded final state. Recovery: Report partial state and the exact failed operation if another save fails; do not announce a successful transfer from the initial click alone.

15. Reject a hierarchy cycle

Request: HQ is North's parent. Someone tries to make North the parent of HQ.

Expected: The service rejects the cycle. Recovery: Agree the intended hierarchy first, then submit a valid parent relationship. A parent must also be active and belong to the same tenant.

16. Review a temporary capability window

Request: Enable an entitled feature from 09:00 on an agreed rollout day until an agreed end date.

1. Confirm the browser's displayed zone and record the intended local times.
2. Preserve existing JSON and other configuration fields.
3. Set Enabled, Effective from and Effective to, then save.
4. Before the start, verify configured state is enabled while runtime availability can still be false.
5. During the window, refresh and check runtime availability plus dependencies.
6. After the end, verify the capability is unavailable according to its configured period.

Expected: A configured enabled value can remain Yes after the window closes. Recovery: Do not remove the end date without a new approved decision. A date window does not grant permissions or create application records.

17. Handle competing appearance edits

Request: Ali and Nadia both open the same draft. Ali saves a new display name while Nadia is choosing a colour scheme.

Nadia must reconcile the latest saved revision before publishing. If her save is refused as a revision conflict, use Reload, compare Ali's saved name and reapply the approved colour change. Save the reconciled draft, review it and publish that saved revision.

Expected: The published result contains the reviewed combination of changes. Recovery: Do not repeatedly submit an old draft or assume Preview draft updated another person's saved revision.

18. An old recovery link stops working

Request: An operator issued link A, then issued link B after the requester reported a problem.

Expected: A is invalid even if its original expiry time has not passed. Recovery: Privately deliver only the newest link. If B expires or the tenant lifecycle invalidates it, verify current state and issue a new link. Never include any of these tokens in the review record.

19. Audit a tenant without mutation privileges

Request: A platform AUDITOR must investigate why onboarding is blocked.

Sign in with the separate auditor identity, inspect the tenant and available audit information, and record the observed blocker. Ask an authorised OPERATOR to perform any approved recovery, entitlement or lifecycle change. Tenant ADMIN membership is not a substitute for operator mutation authority.

Expected: Investigation can proceed without granting mutation powers. Recovery: A missing mutation control is expected for an auditor; do not borrow an operator's session.

20. Prepare an evidence-based access review

Request: Review Omar's access after a change of duties.

Evidence	Example review question
Current account state	Is omar.sales still an active approved account?
All role memberships	Does an old role still supply approval or posting?
Permission sets of retained roles	Are permissions appropriate for the current tasks?
Current operating units and primary	Is South still approved, and is the primary correct?
Capability availability	Are the required modules available for the tenant?
Verification result	Does a fresh sign-in permit the required task and refuse a disallowed task?

Record the approved before/after sets, actor, request reference and observed verification. Store the evidence in your organisation's approved process; the guide does not imply an administration review export or approval queue exists.

Expected: The review distinguishes account, permissions, scope and runtime configuration. Recovery: If one read fails, mark that part unverified and retry; an empty or failed response is not evidence of zero access.