« Back to blog

Simplifying permissions

If you've ever had to configure permissions for other administrators, you'll know there are a lot to choose from. Some of them make more sense than others. If you're not already familiar with permissions, now might be a good time to stop reading—it's going to get a bit intense.

The problem: too many permissions
Currently, for most “things” (e.g. news, links, FAQs), we have 3 levels of permissions: view, edit and delete. And you can grant each of these permissions individually. So you can do clever things, like say that an admin can delete links, but they can't view or edit them. Insert maniacal laugh here.

Taking links as an example, of the 8 possible combinations of view/edit/delete, only 2 really make sense. They are:
  1. you can only view links
  2. you can do anything with links—view, edit and delete them
For most “things”, even students are allowed to view them, so it doesn't really make sense to say that an admin would have less permissions than a student. So that leaves us with one permission that makes sense: “do anything” with links, and 2 possibilities: you either have it or you don't.

How we're going to fix this problem
Starting with news and links, we're going to condense the permissions for each resource down to just 1, “edit”—which means “do anything” with this resource. So, Link.Edit or News.Edit. If you don't have, say, News.Edit, you can still see news in admin (and in the student console), but you can't write, edit or delete news. If you do have that permission, you can do anything related to news. 

We'll be fixing permissions for FAQs and Info Sheets (a.k.a. documents) too over the coming months.

by

| Viewed
times | Favorited 0 times
2 Comments
Jan 17, 2012
jamesmears said...
Hi Luke

It sounds good in theory... but. I don't see there is a problem at the moment. I prefer not to give people the delete options if they do not need them.

For example quite a few people in our very large team at Warwick (82 Admin accounts) have Event.View and Event.Edit meaning that they can add and edit events but they do not have Event.delete - mainly to stop them deleting events by accident ! (You know they will)

Only a small group of 5 people in our "Ops and Info Team" role have the delete options on most items.

It's not that we don't trust people but it is safer not to give delete permissions to large groups of people who could cause chaos of they deleted things by accident. I would really prefer to keep the option of removing the delete option in the roles.

I know that you want to simplify the permissions levels but I do not see a problem with how they work at the moment. Yes you can get it wrong by giving delete permissions but not view but that is all part of the job in setting up the roles properly in a way that works for your users. In my view having a blanket "do anything" permission is asking for problems when something is deleted by accident (I have worked in IT support roles for 12 years.. people will always make mistakes especially if they have the permissions that let them do it).

Best wishes

James

Jan 18, 2012
Luke Sampson said...
Hi James,

Thanks for keeping me on my toes ;)

This change shouldn't cause as much chaos as you're expecting (hopefully none at all), because we have other ways to deal with accidental deletion. And by simplifying permissions, we hope to make things better for all our customers, not just those with a dedicated IT support person like yourself.

Rather than focusing on preventing people from making mistakes, we want to empower them and provide a way to recover when they inevitably do make mistakes. So deleting something is usually undo-able in CareerHub, and accidental deletion isn't as big a problem as on some other systems.

Also worth noting—withholding delete permissions doesn't protect against data loss. Someone could still enter “asdfasdfasdf” in all the fields for an event and it would have a similar effect to deleting it (this is undo-able too, by looking at the change history). So having a separate permission for delete is difficult to justify, when you can do just as much damage with edit.

Most of our customers don't have a dedicated IT support person who can set up permissions. We want permissions to make sense to people whose expertise lies mainly in dealing with people, not just people with an IT background.

Leave a comment...

CareerHub Support

CareerHub Support

CareerHub is a web application used by educational institutions to run their careers services.

This blog covers news and announcements related to CareerHub.

Subscribe to RSS