Role based permissions in Next®

Major new feature for those who work with sensitive or valuable documents in Next®.

Basic permissions in Next® allows you to set up restrictions on who - Users and User groups - can access what documents - Document types.

For example, that only staff in Human Resources can access Pay slips and Employment contracts. And only staff in Sales and Finance, may see Sales Invoices.

 

image2021-3-26_17-23-28.png

Basic permissions are quite advanced


In addition to this you can manually set specific permissions for each document - for example grant View permission to a persons own Employment contract. 

Those with more advanced requirements than this look to the Next® Extended permission control, that allows you to control permissions based on policies and metadata. 


This extension has just become a whole lot more powerful with Role based permissions.


Roles vs User groups

To appreciate the real power of Roles based permissions, we need to understand the core difference between a User group and a Role.

A User group is typically a relatively static organizational unit, such as a department - Finance, Sales, or Engineering.

User groups are often used to set departmental relationships


Adria Leon may be a member of the group Finance together with Beth Ann McDonalds and John Steel.  While Benedict Wade is in Sales with Louis and Sakari.  And both William Dufor and Miriam Hull are in Engineering together with David Rollins and William Dufor.

User groups are most often automatically synchronized with your company's directory service - Active Directory (AD) or LDAP. As the AD already controls their access to network and computer resources, it often makes perfect sense to let it control also access to documents in Next® - linked with AD groups.

While the association with a group may change over time as people move on, the membership itself is unconditional - either you are in Sales or you are not in Sales. 

Roles are different than User groups. If you have the Role as Project Manager, you only hold this Role while you are working on selected projects - your projects. For other projects you may be a Project member - or nothing at all. We say that the Role is conditioned by the context you are in - i.e. the project.


Your Role is different from project to project


For project 21-10 and 21-11 William Dufor is the Project Manager, Miriam Hull and Andy Moore are Project members. 

For project 21-12, Miriam Hull and William Dufor have switched roles.

And for project 21-13 Miriam Hull is all alone, except for Adria Leon, who is always assigned as Project Controller, and David Rollins who is the Division Manager for Engineering. 


When you define Roles, you can easily determine who is to have what kind of access to the documents related to a project:

  • Commercial contracts
  • Technical contracts
  • Project plans
  • Project deliveries
  • Project invoices
  • etc.

...and have Next® enforce this access automatically.  


Define your Roles, and use them to set permission on all the relevant Document types


The Division Manager for Engineering has access to everything and may edit the Commercial and Technical contract. The Project Manager gets access to everything except the Commercial contract, and may edit both Project plans and Project deliveries. The Project Controller can see everything, but edit nothing.  All Project Members may see the Project plan and contribute to Project deliveries. Anyone else - without a connection to the project - can't see any of the project related documents.  

With this in place you can rest assured that this is how every project related document is protected. And as you assign new members to a role, or remove existing ones over time - Next® reflects the change immediately.


Legacy 

Often, when migrating from legacy file systems, people have managed access with individual access control lists - setting individual access rights on each document or file folder. As long as you get this right, it will keep you documents safe. But getting it right is very difficult, and proving it for compliance is even harder. Using what is known as Dynamic Permission Controller, Next® can also assign individual rights on each document - even based on document metadata. But, with Roles based permissions in place we strongly recommend that you define your Roles, and let Next® secure your documents based on that definition. Then, you have automatically documented not only who has access, but also the much more important 'why'.


You have automatically documented not only who has access, but also the much more important 'why'.


Managing user Roles can be done manually in Next® or through integration with an external business system holding for example project role assignments.


Standard configuration

A standard configuration setup is included with the default installation package.

For the techies

Roles are better to use than individual permissions for many reasons. One of them is the fact that you can add and remove people from Roles (and Groups) without the need to update each document and its permissions. The Permissions associated with a User group or a Role is burned into each document at Storage Engine level. Who is currently member of a User group or a Role is determined at run-time. 

Future enhancements

This is the initial release of Roles in Next®. Expect to see several enhancements in the Next® UI used to manage Role assignments. One thing is the ability to see relations both ways. Not only as now: what projects José is a member of, but also the other way - who is a member of project 21-103.

Over the coming releases of Next®, Roles will be implemented in all parts of the product. We expect that eventually you will be able to use Roles anywhere where you today assign a specific User or a User group  

Additional information

Please refer to the online product guide for additional information on this feature, once it is released.

Commercial terms and conditions

This new feature is available as an enhancement to the optional Next® Extended permission control.  

Next® Extended permission control comes with additional license cost, but the Roles enhancement if free of charge for those who already have a license.

Any consultancy assistance will be invoiced separately. 

Disclaimer

Despite our best efforts, we may be forced to change both content and expected delivery of future product updates without notice.  


Details

Title:

Role based permissions in Next®

Type:

New feature

Status:

Released

Release time:

October 2021

Affected products:

Next® Bank Statements
Next® Contracts
Next® Emails
Next® Enterprise Archive
Next® ExCustody
Next® Go
Next® Invoices
Next® Mailroom
Next® Processes

Audience:

Next® Admins
Next® Specialists
Architects
Operations

Classification:

Public

Responsible product manager:

Kim Hellum

Updated:

13.10.2021

By:

Kim Hellum