Authorisation types

Authorisation control allows the targeted allocation of various access authorisations, for example to certain forms, information functions, evaluation lists, etc. For example, it is possible to control that certain forms can only be accessed by certain employees or certain groups, or that an action such as booking or calendar is accessible to all employees.

The following authorisation types can be found in the action permissions:

Client permission	Group permission
Personal permission	Role permission

Authorisation is assigned either via the respective action, in the person master data sheet or via the role.

Client permission

Client permission enables the execution of various actions for all employees of the client. This is particularly useful for actions such as booking, monthly journal, personal settings or changing passwords.

Group permission

Group permission enables the execution of various actions for a specific group (department). The following example shows a group authorisation for the "Bereich Ost" group (marked in red).

It is also possible to extend the group authorisation to the subordinate groups. This gives the subgroups the same access authorisation as the parent group. In our example, the groups "Vienna" and "Consultancy" are therefore also highlighted in red, as these are subgroups of the group "Area East".

Personal permission

The person authorisation makes it possible to grant specific persons execution authorisation for certain actions.

Role permission

The role authorisation allows the execution of various actions only for certain role owners (team leader, supervisor, ...). This authorisation enables role holders to view management lists, for example. All role holders of the selected role in the organisation therefore receive the role authorisation and viewing permission (in accordance with the role competence defined in the role itself > competence target All, person or group).

Access resolution order

Ist eine Personenberechtigung vergeben, so wird auf die Aktion, bzw. Konfiguration zugegriffen, auf welche die Berechtigung besteht.

Wird eine Aktion mit mehreren Konfigurationen in den Menübaum implementiert (z.B. mehrere Varianten des Monatsjournals), so erfolgt der Zugriff auf diese Aktion, bzw. ihre Konfigurationen in einer bestimmten Reihenfolge. Das System überprüft zuerst, ob die Berechtigung einer Person zugeordnet ist, falls nicht wird nach einer Gruppenberechtigung gesucht. Besteht keine Gruppenberechtigung, so wird nach einer Rollenberechtigung gesucht, und anschließend nach der Mandantenberechtigung.

<TODO> REWORK