Vendor roles
Work in progress — these roles are still under development and there may be some changes in the upcoming releases.
Every vendor account has four extra built-in roles that delegate vendor-side or customer-side administration. They are created automatically on vendor accounts and are backed by a local group of the same name (for example Vendor Admin Group), and cannot be deleted. Assign a user to the matching group to grant the role.
-
Vendor Viewer – read-only access to all vendor-side data (the vendor and its sub-vendors and containers).
-
Vendor Admin – manages the vendor, sub-vendors and containers (does not have access to customers).
-
Customer Viewer – read-only access to customer-side data across every customer account under the vendor.
-
Customer Support – full administration of every customer account under the vendor (can not manage vendor itself).
A user can hold several roles at once; the effective permissions are the union of all of them. Regardless of the roles assigned, a user can never reach accounts belonging to a different vendor.
Vendor permissions
These permissions take effect only for users whose own account is a vendor, they have no effect on customer accounts.
Action permissions
Works like ordinary grants:
-
CreateVendorAccount – create a sub-vendor under the vendor.
-
CreateContainer – create a container.
-
DeleteVendorAccount – delete a sub-vendor under the vendor.
-
DeleteContainer – delete a container.
Scope permissions
Scope permissions work differently from ordinary permissions. Instead of enabling a single action, the Access and Modify permissions define the boundary of what a vendor user can reach in the account tree - when one is missing, that part of the tree is hidden or becomes read-only.
-
AccessVendorAccount – lets the user reach and manage the vendor side (the vendor and its sub-vendors and containers). Without it, sub-vendors are hidden and the user cannot manage the vendor account itself.
-
AccessCustomerAccount – lets the user reach the customer accounts under the vendor. Without it, all customer accounts and everything inside them are hidden and inaccessible, including in search.
-
ModifyVendorAccount – grants editing on the vendor side.
-
ModifyCustomerAccount – grants editing on the customer side, and creating customer accounts under the vendor.