Roles

A role is a set of members with the same access right settings that are managed together in the AgilePoint system. A role represents a type of work users do. In AgilePoint, process designer, process manager, and Administrator are common roles.

Background and Setup

Video: Access Control

Video: Manage Your Organization

Examples

Prerequisites

Add or Edit Roles > Basic Role Information tab

Adds or changes a role in AgilePoint NX.

Figure: Add or Edit Roles > Basic Role Information tab

Basic Role Information tab

Fields

Field NameDefinition

Role Name

Description:
Specifies the name for your role.
Allowed Values:
One line of text (a string).

Accepted:

  • Letters
  • Numbers
  • Spaces

Not Accepted:

  • Special characters
Default Value:
None

Description

Description:
A description of the role.
Allowed Values:
More than one line of text.
Default Value:
None
Example:
Refer to:

Add or Edit Roles > Configure Access Rights tab

Adds or changes access rights for the role.

Figure: Add or Edit Roles > Configure Access Rights tab

Configure Access Rights tab

Fields

Field NameDefinition

Access Control

Opens this Screen:
Roles > Access Rights > Access Control tab
Description:
Specifies the permissions for a role.

Apps

Opens this Screen:
Roles > Access Rights > Apps tab
Description:
Specifies the access rights related to AgilePoint NX apps for a role.

Modules

Opens this Screen:
Roles > Access Rights > Modules tab
Description:
Specifies a role's access rights for accessing AgilePoint NX components.

App Builder

Opens this Screen:
Roles > Access Rights > App Builder tab
Description:
Specifies the access rights related to App Builder for a role.

Settings

Opens this Screen:
Roles > Access Rights > Settings tab
Description:
Specifies a role's access rights for managing settings for the AgilePoint NX components.

Analytics

Opens this Screen:
Roles > Access Rights > Analytics tab
Description:
Specifies the permissions for a role in Analytics Center.

Add Role > Configure Access Rights > Access Control tab

Specifies the permissions for a role.

Figure: Add Role > Configure Access Rights > Access Control tab

Add Role Configure Access Rights Access Control tab

Fields

Field NameDefinition

Select All

Description:
Select all the fields listed in the Access Control tab.
Allowed Values:
  • Selected - Selects all the fields in the Access Control tab.
  • Deselected - Selects you select only necessary fields in the Access Control tab.
Default Value:
Deselected

Create And Update Users

Description:
Specifies whether a user can add a user and change the user information.
Allowed Values:
  • Selected - The user can add a user and change the user information.
  • Deselected - The user can not add a user or change the user information.
Default Value:
Deselected

Unregister A User

Description:
Specifies whether a user can delete a user from the AgilePoint system.
Allowed Values:
  • Selected - The user can delete a user from the AgilePoint system.
  • Deselected - The user can not delete a user from the AgilePoint system.
Default Value:
Deselected

Update The User's Own Profile

Description:
Specifies whether a user can change their profile in AgilePoint NX Portal.
Allowed Values:
  • Selected - The user can change their profile in AgilePoint NX Portal.
  • Deselected - The user can not change their profile in AgilePoint NX Portal.
Default Value:
Deselected

Create And Update Roles

Description:
Specifies whether a user can add and change roles.
Allowed Values:
  • Selected - The user can add and change roles.
  • Deselected - The user can not add and change roles.
Default Value:
Deselected

Remove A Role

Description:
Specifies whether a user can delete roles.
Allowed Values:
  • Selected - The user can delete roles.
  • Deselected - The user can not delete roles.
Default Value:
Deselected

Create And Update Groups

Description:
Specifies whether a user can add and change groups.
Allowed Values:
  • Selected - The user can add and change groups.
  • Deselected - The user can not add and change groups.
Default Value:
Deselected

Remove A Group

Description:
Specifies whether a user can delete groups.
Allowed Values:
  • Selected - The user can delete groups.
  • Deselected - The user can not delete groups.
Default Value:
Deselected

Manage App Permissions

Description:
Specifies whether a user can give access right permission to an app.
Allowed Values:
  • Selected - The user can give access control permission to an app.
  • Deselected - The user can not give access control permission to an app.
Default Value:
Deselected

View System Monitor And Cluster Monitor

Description:
Specifies whether a user can access the System Monitor and Cluster Monitor in Manage Center.
Allowed Values:
  • Selected - The user can access the System Monitor and Cluster Monitor in Manage Center.
  • Deselected - The user can not access the System Monitor and Cluster Monitor in Manage Center.
Default Value:
Deselected
Limitations:

Allow To View And Download Audit Trail

Description:
Specifies whether a user can view and download audit logs for the permission group.
Allowed Values:
  • Selected - The user can view and download audit logs.
  • Deselected - The user can not view and download audit logs.
Default Value:
Deselected
Limitations:

This field is available in these releases:

Create, Update, And Remove Event Services

Description:
Specifies whether a user can add, delete, and change event services.
Allowed Values:
  • Selected - The user can add, delete, and change event services.
  • Deselected - The user can not add, delete, and change event services.
Default Value:
Deselected

Create, Update, And Remove Webhooks

Description:
Specifies whether a user can add, delete, or change webhooks in Manage Center.
Allowed Values:
  • Selected - The user can add, delete, or change webhooks.
  • Deselected - The user can not change webhooks.
Default Value:
Deselected
Limitations:

This field is available in these releases:

Create, Update, Remove Custom Views And Quick Launch

Description:
Specifies whether a user can add, delete, and change custom views and forms or views on the Quick Launch menu in Modern Work Center.
Allowed Values:
  • Selected - The user can add, delete, and change custom views and forms or views on the Quick Launch menu.
  • Deselected - The user can not change the items on the Quick Launch menu.
Default Value:
Deselected
Limitations:

This field is available in these releases:

Add, Remove, And Modify Global Application Resources

Description:
Specifies whether a user can add, delete, and change global application resources such as global email templates, global access tokens, shared variables, and eForm settings.
Allowed Values:
  • Selected - The user can add, delete, and change global application resources.
  • Deselected - The user can not add, delete, and change global application resources.
Default Value:
Deselected

View Global Application Resources

Description:
Specifies whether a user can see the global application resource, such as email templates, access tokens, and global variables.
Allowed Values:
  • Selected - The user can see the global application resources.
  • Deselected - The user can not not see the global application resources.
Default Value:
Deselected

Use System Account In Apps Or Access Tokens

Description:
Specifies whether a user can give access to AgilePoint Service Account. (The AgilePoint Service Account is sometimes referred to as the AgilePoint System Account.)
Allowed Values:
Default Value:
Deselected
Example:
Refer to:

Add Role > Configure Access Rights > Apps tab

Specifies the access rights related to AgilePoint NX apps for a role.

Figure: Add Role > Configure Access Rights > Apps tab

Add Role Configure Access Rights Apps tab

Fields

Field NameDefinition

Select All

Description:
Selects all the fields listed in the process tab.
Allowed Values:
  • Selected - Selects all the fields in the process tab.
  • Deselected - Selects only the necessary fields in the process tab.
Default Value:
Deselected

Add Or View Delegations For Other Users

Description:
Specifies whether a user can add or view delegations.
Allowed Values:
  • Selected - The user can add and view delegations.
  • Deselected - The user can not add and view delegations.
Default Value:
Deselected
Limitations:

This field is available in these releases:

Cancel A Task

Description:
Specifies whether a user can cancel any tasks they can see in Work Center or Manage Center.
Allowed Values:
  • Selected - The user can cancel any tasks they can see.
  • Deselected - The user can not cancel any tasks.
Default Value:
Deselected

Cancel Own Tasks

Description:
Specifies whether a user can cancel the tasks assigned to them.
Allowed Values:
  • Selected - The user can cancel the tasks assigned to them.
  • Deselected - The user can not cancel the tasks assigned to them.
Default Value:
Deselected
Limitations:

This field is available in these releases:

Complete System Activities (Automated Tasks)

Description:
Specifies whether the Complete Automatic Work Item and Complete Procedure API methods can execute if trustedAuthorization is set to False on the AgilePoint Server.
Limitations:
This access right only applies in these conditions:
  • AgilePoint NX OnPremises or AgilePoint NX PrivateCloud.
  • In the AgilePoint Server netflow.cfg file, trustedAuthorization is set to False.

    By default, trustedAuthorization is set to True. As such, this access control only applies if this configuration setting is changed on the AgilePoint Server.

  • A system activity or custom AgilePart runs.

    More specifically, this access control tends to affect asynchronous type system activities, which must wait for input from an external system, such as a database or cloud-based service. If both trustedAuthorization and the Mark Automatic Work Item Completion access control are turned off (deselected or set to False), and the Complete Automatic Work Item method is called (usually from an API application), asynchronous activities may throw an Access Denied exception.

  • System activities do not require intervention from human users. Therefore, this access control usually applies to either a user account associated with an API method call, or the AgilePoint Service Account. The Service Account is sometimes also used for API applications.
Allowed Values:
  • Selected - If trustedAuthorization is set to False, the Complete Automatic Work Item API method can execute.

    This setting has no effect in these cases:

  • Deselected - If trustedAuthorization is set to False, access to the Complete Automatic Work Item API method is denied.

    For more information, refer to Why Do I Get an Access Denied Error for an API Method Call?

Default Value:
Deselected

Create A Task

Description:
Specifies whether a user can create a task in Work Center.
Allowed Values:
  • Selected - The user can create a task.
  • Deselected - The user can not create a task.
Default Value:
Deselected

Create, Update, And Remove Delegations

Description:
Specifies whether a user can create, change, and delete delegations.
Allowed Values:
  • Selected - The user can create, change, and delete delegations.
  • Deselected - The user can not create, change, and delete delegations.
Default Value:
Deselected

Reassign A Task

Description:
Specifies whether a user can assign a task to different participant.
Allowed Values:
  • Selected - The user can assign a task to a different participant.
  • Deselected - The user can not assign a task to a different participant.
Default Value:
Deselected

View All Tasks In Work Center

Description:
Specifies whether to show all the tasks in the All Tasks view in Work Center.
Allowed Values:
  • Selected - Shows all the tasks in the All Tasks view.
  • Deselected - Does not show all the tasks in the All Tasks view.
Default Value:
Deselected

View My Peer Group In Work Center

Description:
Specifies whether to show the tasks in the My Group Peers view in Work Center.
Allowed Values:
  • Selected - Shows the tasks in the My Group Peers view.
  • Deselected - Does not show the tasks in the My Group Peers view.
Default Value:
Deselected

Reassign Own Task

Description:
Specifies whether a user can assign a task assigned to them to different participant.
Allowed Values:
  • Selected - The user can assign a task assigned to them to different participant.
  • Deselected - The user can not assign a task assigned to them to different participant.
Default Value:
Deselected
Limitations:

This field is available in these releases:

Archive And Restore Processes

Description:
Specifies whether a user can archive and restore processes.
Allowed Values:
  • Selected - The user can archive and restore processes.
  • Deselected - The user can not archive and restore processes.
Default Value:
Deselected

Cancel A Process

Description:
Specifies whether a user can cancel any process instance in Manage Center.
Allowed Values:
  • Selected - The user can cancel a process.
  • Deselected - The user can not cancel a process.
Default Value:
Deselected

Cancel Own Process Instances

Description:
Specifies whether a user can cancel the process instances they started.
Allowed Values:
  • Selected - The user can cancel their own process instances.
  • Deselected - The user can not cancel their own process instances.
Default Value:
Deselected
Limitations:

This field is available in these releases:

Initiate A Process

Description:
Specifies whether a user can start a process instance.
Allowed Values:
  • Selected - The user can start a process.
  • Deselected - The user can not start a process.
Default Value:
Deselected

Resend And Cancel An Email Notification

Description:
Specifies whether a user can resend or cancel an email notification.
Allowed Values:
  • Selected - The user can resend or cancel an email notification.
  • Deselected - The user can not resend or cancel an email notification.
Default Value:
Deselected

Rollback A Process

Description:
Specifies whether a user can roll back a process instance to any activity without cancelling or stopping the running process.
Allowed Values:
  • Selected - The user can roll back a process instance.
  • Deselected - The user can not roll back a process instance.
Default Value:
Deselected

Suspend And Resume A Process

Description:
Specifies whether a user can pause or continue a process.
Allowed Values:
  • Selected - The user can pause or continue a process.
  • Deselected - The user can not pause or continue a process.
Default Value:
Deselected

View Process Details

Description:
Specifies whether a user can see the information about the process.
Allowed Values:
  • Selected - The user can see information about the process.
  • Deselected - The user can not see information of the process.
Default Value:
Deselected

Create, Update, And Remove Shared Variables

Description:
Specifies whether a user can add, remove, and change shared variables.
Allowed Values:
  • Selected - The user can add, remove, and change shared variables.
  • Deselected - The user can not add, remove, and change shared variables.
Default Value:
Deselected

Allow To Execute QueryDatabase() And QueryDatabaseEx()

Description:
Specifies whether the Query Database and Query Database (Extended Method) API methods can execute if trustedAuthorization is set to False on the AgilePoint Server.
Limitations:
This access right only applies in these conditions:
Allowed Values:
  • Selected - If trustedAuthorization is set to False, the Query Database and Query Database (Extended Method) API method can execute.
  • Deselected - If trustedAuthorization is set to False, access to the Query Database and Query Database (Extended Method) API method is denied.

    For more information, refer to Why Do I Get an Access Denied Error for an API Method Call?

Default Value:
Deselected

Update Variables

Description:
Specifies whether a user can change variables.
Allowed Values:
  • Selected - The user can change variables.
  • Deselected - The user can not change variables.
Default Value:
Deselected

View Variables

Description:
Specifies whether a user can see variables in Process Builder or eForm Builder.
Allowed Values:
  • Selected - The user can see variables.
  • Deselected - The user can not see variables.
Default Value:
Deselected

Add Role > Configure Access Rights > Modules tab

Specifies a role's access rights for accessing AgilePoint NX components.

Figure: Add Role > Configure Access Rights > Modules tab

Add Role Configure Access Rights Modules tab

Fields

Field NameDefinition

Select All

Description:
Selects all the fields on the tab.
Allowed Values:
  • Selected - Selects all the fields on the tab.
  • Deselected - Selects only the necessary fields.
Default Value:
Deselected

Enable Work Center Access

Description:
Specifies whether a user can use Work Center.
Allowed Values:
  • Selected - The user can use Work Center.
  • Deselected - The user can not use Work Center.
Default Value:
Deselected

Enable Analytics Center Access

Description:
Specifies whether a user can use Analytics Center.
Allowed Values:
  • Selected - The user can use Analytics Center.
  • Deselected - The user can not use Analytics Center.
Default Value:
Deselected
Limitations:
  • Analytics Center is installed and licensed in your environment.

Enable App Builder Access

Description:
Specifies whether a user can use App Builder and Data Entities.
Allowed Values:
  • Selected - The user can use App Builder and Data Entities.
  • Deselected - The user can not use App Builder and Data Entities.
Default Value:
Deselected

Enable App Store Access

Description:
Specifies whether a user can use the App Store.
Allowed Values:
  • Selected - The user can use the App Store.
  • Deselected - The user can not use the App Store.
Default Value:
Deselected

Enable Collaboration Access

Description:
Specifies whether a user can use Collaboration Center.
Allowed Values:
  • Selected - The user can use Collaboration Center.
  • Deselected - The user can not use Collaboration Center.
Default Value:
Deselected

Enable Manage Center Access

Description:
Specifies whether a user can use Manage Center.
Allowed Values:
  • Selected - The user can use Manage Center.
  • Deselected - The user can not use Manage Center.
Default Value:
Deselected

Enable Announcements And System Notification Access

Description:
Specifies whether a user can see announcements and system notifications on the AgilePoint NX Portal home page.
Allowed Values:
  • Selected - The user can see announcements and system notifications.
  • Deselected - The user can not see announcements and system notifications.
Default Value:
Deselected

Add Role > Configure Access Rights > App Builder tab

Specifies the access rights related to App Builder for a role.

Figure: Add Role > Configure Access Rights > App Builder tab

Add Role > Configure Access Rights > App Builder tab

Fields

Field NameDefinition

Select All

Description:
Selects all the fields on the tab.
Allowed Values:
  • Selected - Selects all the fields on the tab.
  • Deselected - Selects only the necessary fields.
Default Value:
Deselected

Create, Delete, And Import Apps

Description:
Specifies whether a user can add, delete, and import apps.
Allowed Values:
  • Selected - The user can add, delete, and import apps.
  • Deselected - The user can not add, delete, and import apps.
Default Value:
Deselected

Enable Anonymous End User Access

Description:
Specifies whether a user can give anonymous access to a runtime app user to submit an eForm or to see a custom page with no authentication.
Allowed Values:
  • Selected - A runtime app user can submit a form or to use a custom page with no authentication.
  • Deselected - A runtime app user must sign in to AgilePoint NX to submit a form or use a custom page.
Default Value:
Deselected

Check In And Check Out Application Resources

Description:
Specifies whether a user can check in and check out application resources.
Allowed Values:
  • Selected - The user can check in and check out application resources.
  • Deselected - The user can not check in or check out application resources.
Default Value:
Deselected

Check In Or Undo Check Out Another User's Changes

Description:
Specifies whether a user can check in and check out changes from other users.
Allowed Values:
  • Selected - The user can check in and check out changes made by other users.
  • Deselected - The user can not check in and check out changes made by other users.
Default Value:
Deselected

Create, Update, And Remove Application Resources

Description:
Specifies whether a user can add, delete, and change application resources.
Allowed Values:
  • Selected - The user can add, delete, and change the application resources.
  • Deselected - The user can not add, delete, and change the application resources.
Default Value:
Deselected

Publish Apps

Description:
Specifies whether a user can release or publish apps.
Allowed Values:
  • Selected - The user can release or publish apps.
  • Deselected - The user can not release or publish apps.
Default Value:
Deselected

Undo Check Out The User's Own Files

Description:
Specifies whether a user can undo a check out for their files.
Allowed Values:
  • Selected - The user can undo a check out for their files.
  • Deselected - The user can not undo a check out for their files.
Default Value:
Deselected

Create Process Models

Description:
Specifies whether a user can create process models.
Allowed Values:
  • Selected - The user can create process models.
  • Deselected - The user can not create process models.
Default Value:
Deselected

Check In And Check Out Process Models

Description:
Specifies whether a user can check in and check out process models.
Allowed Values:
  • Selected - The user can check in and check out process models.
  • Deselected - The user can not check in or check out process models.
Default Value:
Deselected

Release A Process Model

Description:
Specifies whether a user can release a process model.
Allowed Values:
  • Selected - The user can release a process model.
  • Deselected - The user can not release a process model.
Default Value:
Deselected

Delete Process Models

Description:
Specifies whether a user can delete process models.
Allowed Values:
  • Selected - The user can delete process models.
  • Deselected - The user can not delete process models.
Default Value:
Deselected

Save And Remove Temporary Files (API)

Description:
Specifies whether the Save Temporary File and Remove Temporary File API methods can execute if trustedAuthorization is set to False on the AgilePoint Server.
Limitations:
This access right only applies in these conditions:
Allowed Values:
  • Selected - If trustedAuthorization is set to False, the Save Temporary File and Remove Temporary File API method can execute.

    This setting has no effect in these cases:

    • trustedAuthorization is set to True
  • Deselected - If trustedAuthorization is set to False, access to the Save Temporary File and Remove Temporary File API method is denied.

    For more information, refer to Why Do I Get an Access Denied Error for an API Method Call?

Default Value:
Deselected

View And Modify System Configuration

Description:
Specifies whether a user can see and change the AgilePoint system configuration.
Allowed Values:
  • Selected - The user can see and change the AgilePoint system configuration.
  • Deselected - The user can not see and change the AgilePoint system configuration.
Default Value:
Deselected

Add Role > Configure Access Rights > Settings tab

Specifies a role's access rights for managing settings for the AgilePoint NX components.

Figure: Add Role > Configure Access Rights > Settings tab

Add Role Configure Access Rights Settings tab

Fields

Field NameDefinition

Select All

Description:
Selects all the fields listed on the Settings tab.
Allowed Values:
  • Selected - Selects all the fields on the Settings tab.
  • Deselected - Selects only the necessary fields on the Settings tab.
Default Value:
Deselected

Manage Configuration Settings

Description:
Specifies whether a user can change system settings.
Allowed Values:
  • Selected - The user can change system settings.
  • Deselected - The user can not change system settings.
Default Value:
Deselected

Manage Settings For Administration

Description:
Specifies whether a user can enable authentication providers and add users to AgilePoint NX on the Administration screen.
Allowed Values:
  • Selected - The user can enable authentication providers and add users on the Administration screen.
  • Deselected - The user can not enable authentication providers and add user on the Administration screen.
Default Value:
Deselected

Manage Settings For Analytics Center

Description:
Specifies whether a user can change the settings for Analytics Center.
Allowed Values:
  • Selected - The user can change the settings for Analytics Center.
  • Deselected - The user can not change the settings for Analytics Center.
Default Value:
Deselected

Manage Settings For App Builder

Description:
Specifies whether a user can change the settings for App Builder.
Allowed Values:
  • Selected - The user can change the settings for App Builder.
  • Deselected - The user can not change the settings for App Builder.
Default Value:
Deselected

Manage Settings For Manage Center

Description:
Specifies whether a user can change the settings for Manage Center.
Allowed Values:
  • Selected - The user can change the settings for Manage Center.
  • Deselected - The user can not change the settings for Manage Center.
Default Value:
Deselected

Manage Settings For Mobile Apps

Description:
Specifies whether a user can change the settings for Mobile Apps.
Allowed Values:
  • Selected - The user can change the settings for Mobile Apps.
  • Deselected - The user can not change the settings for Mobile Apps.
Default Value:
Deselected

Manage Settings For NX Portal

Description:
Specifies whether a user can change the settings for AgilePoint NX Portal.
Allowed Values:
  • Selected - The user can change the settings for NX Portal.
  • Deselected - The user can not change the settings for NX Portal.
Default Value:
Deselected

Manage Settings For The Tenant

Description:
Specifies whether a user can change the settings for the AgilePoint NX tenant.
Allowed Values:
  • Selected - The user can change the settings for the AgilePoint NX tenant.
  • Deselected - The user can not change the settings for the AgilePoint NX tenant.
Default Value:
Deselected

Manage Settings For Work Center

Description:
Specifies whether a user can change the settings for Work Center.
Allowed Values:
  • Selected - The user can change the settings for Work Center.
  • Deselected - The user can not change the settings for Work Center.
Default Value:
Deselected

Add Role > Configure Access Rights > Analytics tab

Specifies the permissions for a role in Analytics Center.

Figure: Add Role > Configure Access Rights > Analytics tab

Add Role Configure Access Rights Analytics tab

Prerequisites

Fields

Field NameDefinition

Role Type

Description:
Specifies the type of role for Analytics Center.
Allowed Values:
  • Advanced Report Creator - Associated users can add, remove, and change the advanced reports, dashboards, and schedules in Analytics Center.
  • Report Viewer - Associated users can subscribe, print, email, export, and view history of reports, and dashboards in Analytics Center.
  • Basic Report Creator - Associated users can add, remove, and change the basic reports, dashboards, and schedules in Analytics Center.
  • Administrator - Associated users have all permissions for the Analytics Center.
  • Custom - Associated users can configure permissions on the Analytics screen (Settings).
Default Value:
Report Viewer

Manage Analytics Settings

Opens this Screen:
Analytics screen (Settings)

Add Role > Select Members tab

Adds members to a role.

Figure: Add Role > Select Members tab

Add Role Select Members tab

Fields

Field NameDefinition

Search Search icon

Function:
Does a search based on the specified permission group members.

Add Member Add Member icon

Function:
Adds the specified users or groups to the role permission group.

Delete Delete icon

Function:
Deletes the specified member from the role.

Current Member

Description:
Shows the members for the role.
Allowed Values:
Read only.

Type

Description:
Shows the types of members in the App Owners permission group.
Allowed Values:
Read only.

Available Members screen

Adds members to a permission group.

Figure: Available Members screen

Permissions > Available Members screen

Fields

Field NameDefinition

Group / User Name / Full Name

Description:
Specifies whether to add a user or group to the permission group.
Allowed Values:
  • Group
  • User Name
  • Full Name
Default Value:
Group
Example:
Refer to:

Search Available Member Search Available Member icon

Function:
Does a search based on the specified text.
Example:
Refer to: