Assign roles within a controlled scope

Purpose

A role becomes useful when an administrator assigns it where the colleague will work. The assignment records that scope and makes the decision available for later review.

How It Works

The administrator opens the colleague’s role management view and chooses an available role. Customer-wide and selected-workspace choices support different responsibilities. Supported record scopes serve narrower work through their own assignment surface. The delegation check explains missing authority before an excessive grant can take effect. Pending membership and future validity windows affect when an otherwise valid offer can be used. Scope editing reconciles existing assignments rather than ask staff to rebuild each row manually. Withdrawal preserves the history needed to explain earlier access. The Access view lets an administrator inspect the evaluated permissions and their origins. Staff authority remains on the HQ administration surface, keeping it separate from customer role management.

Relationships

• Role and policy definitions supply the assigned authority.
• Authorization evaluation supplies delegation checks and permission explanations.
• Automatic assignment owns derived grants that ordinary management cannot edit.
• Security history records assignment decisions and refusals.