Security (Authorization)
Roles
Roles define what operations users can perform on records and the system in Robosme. The authorization structure is fundamentally shaped by whether the record has ownership or not.
Multiple roles can be assigned to a user. Among the user's roles, the most comprehensive one for the same permission is considered valid.
Role Levels
Role levels vary depending on whether the concept's ownership feature is active or not.
Concepts with Active Ownership Feature
(Example: standard business records, activities, user concept)
In this case, roles are evaluated at 4 levels:
User / Team
The user has authority over records that belong to them and the teams they are a member of.
Team Members
The user has authority over records that belong to:
- Themselves
- Teams they are a member of
- Other users in the teams they are a member of
Hierarchy
The user gains hierarchical access including:
- Teams they are a member of
- Sub-teams under these teams
- Users in sub-teams
Organization
The user has authority over all records in the organization.
Concepts Without Ownership Feature
If a concept does not have ownership, the role structure is limited to 2 levels:
- Unauthorized
- Organization
In these types of concepts, team and hierarchy-based distinctions are not applied.
Role Permission Types
Roles consist of permission types that determine what operations users can perform on records. Each permission type is evaluated together with the role levels mentioned above.
Create
Permission to create new records.
Only Unauthorized and Organization levels apply.
When creating a record with an owner other than themselves or their team, it functions together with the Assign permission.
Affects adding connections in many-to-many relationships.
Read Permission to view record content.
Update Permission to make changes to records.
Delete
Permission to permanently delete records.
Affects removing connections in many-to-many relationships.
Assign
Permission to change record owner. Functions together with Update permission.
Only meaningful in concepts with active ownership feature.
Share
Permission to grant record-level access to unauthorized users. Functions together with special permissions.
Provides record-specific authorization for records at levels the user does not have access to.
Only applicable for concepts with active ownership.
Export to Excel
Permission to export records.
Only Unauthorized and Organization levels apply.
Sharing Roles
Sharing roles control record-level access and operate independently of standard role permissions.
During sharing, the system can optionally enforce the following checks:
- Does the user actually have permission to the record they are sharing?
- Does the user receiving the share have at least a minimum role for the related concept?
These checks are managed through the sharing role.
System Roles
In addition to concept-based permissions, there are system-wide roles.These permissions are managed from the second tab of the role definition screen and are activated depending on the plan being used.
These permissions determine whether the user can view specific management screens and perform operations in these areas.
CustomizationPermission to access and manage customization screens such as forms, lists, dashboards.
If the user does not have this permission, they cannot access the customization section in the settings menu.
Plugins
Permission to access and manage application-specific code developments and plugins. Without permission, the plugin list cannot be accessed.
Scripts
Permission to access and manage application-specific scripts. Without permission, the script list cannot be accessed.
Data Import
Permission to import data via Excel.
Without permission, the user cannot access the data management section in the settings menu, download Excel import templates, or update and reload records exported to Excel.
System Settings
Permission to manage system settings. Without permission, system settings cannot be accessed.
Security Settings
Permission to manage security settings. Without permission, security settings cannot be accessed.
Email Settings
Permission to manage email server profiles and mailboxes. Without permission, the user cannot access the email configuration section in the settings menu.
Send Email on Behalf of Others
Allows the user to send emails on behalf of another user.
This permission works in conjunction with the relevant user's "Allow sending email on my behalf" setting.
Can Update Inactive Records
Permission to update records in inactive status.
Check Concept Access When Accessing Shared Records
Permission for the user to bypass concept permission checks when accessing a record that has been shared with them.
For example, when a case record read permission is shared with the user, they would normally need at least ownership-level read permission on the case concept. With this permission, they can read the case record without needing to check the read permission on the case concept.
Check Record Permission When Sharing
Permission for the user to share a record even without having the permission they want to share.
For example, when the user wants to share update permission for a sales record, they would normally need to have update permission for that record. With this permission, they can share the sales record with update permission without needing to check if they have update permission.
Mentor Alert
The most common mistake when designing roles is granting organization level or system roles excessively. When team, hierarchy and system roles are properly configured, both security and control are naturally maintained.