Set portal roles, groups, and the permission ceiling

Portal roles decide what each person at a client can do in the portal. The permission ceiling decides the most that anyone at that client can do, whatever their roles say. Use roles to fit the client’s own people, and the ceiling to keep the portal within what you have agreed to offer that client.

Before you begin

• Editing roles and groups needs clientportal:users. Setting the ceiling needs clientportal:manage.
• For the full list of portal permissions, see Client portal permissions.

How access is worked out

A person’s permissions are every permission of every role they hold directly, plus every role of every group they belong to, limited to what the client’s ceiling allows. Some permissions include others, such as Pay invoices, which includes View invoices and payments.

The result is worked out on every request and never cached. A change to a role, a group, or the ceiling applies to the person’s next request.

The ready-made roles

Every client starts with five roles:

Role	For
Owner	Everything the ceiling allows, including people, roles, and remote access. It cannot be edited or deleted.
Billing	Invoices, payments, autopay, the next bill estimate, and quotes.
Approver	Accepting quotes and milestones, and answering approval requests.
IT contact	Tickets, devices, reports, remote access, and starter and leaver requests.
Read only	Seeing everything a read permission covers, and changing nothing.

You can edit every ready-made role except Owner, but not delete them. You can also add your own roles. Role names are unique per client.

Edit a role

1. On the client’s Client portal tab, select Roles.
2. Select a role to edit it, or New role.
3. Tick the permissions in the tree. Permissions the ceiling does not allow are shown as Not allowed by the ceiling.
4. Select Save role or Create role.

Owner shows Everything the ceiling allows. A role that holds more than the ceiling allows shows the extra permissions under Not allowed by the ceiling. They are kept on the role and given to nobody.

Set the permission ceiling

The ceiling is per client. Nobody in that client’s portal can do more than it allows, whatever their roles grant.

1. On the client’s Client portal tab, select Permission ceiling.
2. Choose one:
   • Turn on No ceiling: allow every portal permission, including ones added in later releases.
   • Turn it off and tick the permissions the client may use.
3. Before you save, These roles hold more than this ceiling allows lists each role the new ceiling would clip.
4. Select Save ceiling.

Lowering the ceiling rewrites no role. What a role holds above the ceiling is shown grayed on Roles, and comes back if you raise the ceiling again. In the portal, the client sees it as not allowed by your portal name.

Remote access has a ceiling of its own. See Let clients use remote access.

What a client’s owners can do

People with Manage users and roles can manage their own organization in the portal, with these limits:

• They can create or edit a role only with permissions they hold themselves.
• They can give someone a role, or add them to a group, only when everything it grants is within their own permissions.
• They cannot change their own roles or groups, except to leave one.
• They cannot remove the last active owner.
• Every permission they save must be within your ceiling.

You are bound by the ceiling only.

Verify

Select View as on a user on Users. It shows what they can do, what the ceiling clips, and what nothing grants. See Invite and manage portal users.

Next steps

• Client portal permissions
• Let clients use remote access