Permissions

Permissions decide what a user can do in Weissr Capex. You assign them to user groups, and every member of a group inherits them. This page explains how the permission model works, where in Administration you manage it, and lists every permission in the three application areas: Common, Capex Management and Capex Strategy.

It is written for administrators and superusers setting up or reviewing access in your organization.

How permissions work

Four rules cover almost everything:

• Permissions are assigned to user groups, never to individual users. A user gets a permission by belonging to a group that has it.

• A group can hold a permission only once. A group can have many permissions, but you cannot assign the same one to it twice.

• A permission is either on or off, or it has a level. On or off permissions are a single checkbox. Level based permissions have three: Create, Edit and Read.

• Most permissions apply system-wide, but some are granted per node in the Organizational Structure. Both Capex Management and Capex Strategy have permissions of this kind.

Permission levels: Read, Edit and Create

Level based permissions are marked Is CRUD in the Administration pages, and Read, Edit, Create in the reference tables further down. Each level includes the ones below it, so you only ever tick the highest level a group needs.

📌 Note: There is no separate delete checkbox. Create is what allows a group to delete objects, so treat it as the highest level of trust.

📌 Note: Read cannot be switched off. Once a level based permission is assigned to a group, Read is always on and the checkbox is greyed out. In the same way, Edit is locked once Create is ticked, because the higher level already includes it.

What happens when a user belongs to several groups

Weissr merges the permissions of all the groups a user belongs to into one list. Each permission appears once in that list, at the highest level granted by any of the groups. A user who has Read through one group and Create through another ends up with Create.

Permissions are only ever added this way. A group cannot take away something another group has granted.

Permissions tied to the Organizational Structure

Not every permission is granted system-wide. Some are granted per node, so a group can hold them in one part of the organization and not in another. Both applications have permissions of this kind, and they are managed in different places.

Three ways to tell a node permission from a system-wide one:

• The Scope column in the reference tables below reads Node or Division instead of Global.

• On the Permissions page, a node permission offers a Node assignments... button where a global permission offers Assignments....

• Node permissions never appear in the Permission matrix. The matrix lists global permissions only.

📌 Note: Division is a narrower kind of node permission. A Division permission can only be placed on a node whose type is Division or Group, not on any node in the tree. Two Capex Strategy permissions work this way: Base alternative and Strategic alternative.

👉 Assigning Permissions in the Organizational Structure

Where to manage permissions

Global permissions are managed under Administration → Security. You need the Administrator or Superuser permission to open it.

Give one group its permissions

Location: Administration → Security → User groups

1. Find the group in the list and open its Action menu.

2. Choose Permissions. The dialog Edit permissions for user group opens.

3. Pick a permission in Add permission. It is assigned straight away.

4. For a level based permission, tick Create or Edit in the row. Read is already on.

5. To take a permission away, use the remove button at the end of its row.

Assigned permissions are grouped into one card per application area, so you can see at a glance what the group can do in Common, Capex Management and Capex Strategy.

Give one permission to several groups at once

Location: Administration → Security → Permissions

1. Find the permission in the list and click Assignments....

2. In User groups, select every group that should have it. Each change is saved immediately.

3. The Users card below the selector lists everyone who now inherits the permission, so you can check the result before closing the dialog.

💡 Tip: This dialog assigns the permission at Read level. To grant Edit or Create, go to the Permission matrix or the group's own Permissions dialog afterwards.

Set many permissions at once with the Permission matrix

Location: Administration → Security → Permissions → Permission matrix

The matrix is the fastest way to set up a new environment or review an existing one. Permissions run across the columns, user groups down the rows, and you tick the intersection.

• The matrix is split into three tabs: Common, Capex Strategy and Capex Management.

• Level based permissions show three checkboxes, Create, Edit and Read. On or off permissions show one.

• Only global permissions appear here. Node and Division permissions are granted in the Organizational Structure instead.

🔒 Two cells are deliberately locked. You cannot grant Superuser unless you are a superuser yourself, and you cannot change the permissions of a group you belong to. Ask a colleague to make that change.

Grant a permission on part of the organization

Location: Administration → Capex Management → Organizational structure, or Administration → Capex Strategy → Nodes

Node and Division permissions are granted on the node itself. Select the node in the tree, then assign the permission to a user group or user on the right. For Capex Strategy, select the project first, because each project has its own structure.

📌 Note: The CS node permissions and CM node permissions items in the Users and User groups action menus are read-only views. They show what a user or group already holds, node by node. To change anything, go to the Organizational structure.

See what a single user can do

Location: Administration → Security → Users

Open the user's Actions menu and choose Permissions. The dialog lists every global permission the user has inherited from their groups, with the application area and the Create, Edit and Read levels. This view is read-only. To change what the user can do, change their group membership or the permissions of their groups. For node permissions, use CS node permissions or CM node permissions in the same menu.

See who holds a given permission

Location: Administration → Security → Permissions

Click Assignments... on the permission, or Node assignments... if it is a node permission. The dialog lists the user groups that hold it and the users who inherit it. This is the quickest answer to "who can approve requests" or "who has Superuser".

Permission change log

Every permission change is recorded: the group, the permission, the action taken, the user who made the change and the time. Assignment, un-assignment and changes to the Create, Edit and Read levels are all tracked.

📌 Note: Log entries identify a permission by its ID number, not its name. Use the ID column in the tables below to look it up.

Permission reference

The three tables below list the permissions in each application area.

• ID is the number used in the change log.

• Level is On/off for a single checkbox, or Read, Edit, Create for a permission with levels.

• Scope is Global for a permission granted system-wide in Administration → Security, or Node or Division for one granted per node in the Organizational Structure.

Common permissions

Capex Management permissions

Capital Budgeting permissions are part of Capex Management and are marked in the descriptions below.

Capex Strategy permissions

📌 Note: Base alternative, Strategic alternative and Strategic building block work as one family. Which of the three is checked depends on the type of the alternative being opened, and the check runs against the alternative's own node and the nodes above it. On top of that, a user needs View Node And Sub Nodes on at least one node in the alternative's structure, unless they hold Administrator.