Role-Based Access Control

we've introduced access permissions for organization end user roles this article provides the following information on creating and managing role based access control (rbac) within your organization /#overview of rbac /#organization roles /#ditto employee access grants overview of rbac previously, all end user roles within an organization had the same access to app data with the latest release, you can set fine grained read write access controls to app data for instance, create, modify, and delete custom roles; establish organization hierarchies for permissions delegation; set permissions for portal functionality like viewing collections, querying tokens, transferring apps between organizations; and more since implementing role based access control, organization members no longer have read write access to app data by default to regain access, create custom roles that include permissions for accessing and modifying app data, and then assign these roles to the appropriate organization members for instructions, see /#organization roles and /#assigning roles to end users organization permissions settings when configuring access control for roles within an organization, there are various types of privileges you can choose from available within the portal > settings > roles , the following graphic and corresponding table provide an overview of the various settings you can configure for roles within an organization as indicated using matching superscript numbers, some privileges have one or more dependencies with other privileges for example ¹ selecting accept incoming app transfer requests automatically toggles view incoming app transfer requests , granting both read and write privileges ² selecting access audit logs automatically toggles view access grants , granting view access to active app transfer requests item setting description 1 accept incoming app transfer requests ¹ initiate, approve, or cancel requests to transfer apps between organizations 2 create an app set up new apps 3 view organization details access and view details related to the organization 4 reject incoming app transfer requests decline requests from other organizations to transfer apps to the organization 5 view access grants ²𝄒⁴ review the permissions granted to specific users, roles, or organizations 6 access audit logs ²𝄒³ review audit logs 7 manage organization members oversee and administer the membership of an organization 8 view incoming app transfer requests ¹𝄒²𝄒³ see requests from other organizations to transfer apps into the organization 9 update the organization details modify information related to the organization 10 manage access grants ⁴ control and administer access privileges granted to other roles within the organization app permissions settings following is an overview of the various settings that, once assigned, grant end users the ability to manage the app (see /#organization roles ) item setting description 1 cancel a request for an app transfer withdraw active requests to transfer apps to other organizations 2 delete an app ⁵ permanently remove apps 3 delete api keys ⁷ revoke authentication and authorization to access to app data 4 view app details access and review specific information and settings associated with apps 5 access offline only licenses ²𝄒⁶ view the licenses designating apps for offline usage 6 update app details modify the information and settings associated with apps 7 modify app data ⁵ make changes to mesh generated transactional data 8 request offline only licenses ⁶ manage the licenses designating apps for offline usage 9 create api keys ⁶𝄒⁸ generate unique identifiers used for authentication and authorization access to app data 10 view app metrics review various analytics associated with apps 11 access api keys ²𝄒⁶𝄒⁷𝄒⁸ view the api keys used for authentication and authorization to access app data 12 initiate a request for the transfer of an app transfer ownership of apps to other organizations organization roles to establish role based access controls for your organization create new roles with the desired settings ( /#creating new roles ) designate roles for the appropriate end users within your organization ( /#creating new roles ) creating new roles to add a new role to your organization from your organization, click settings click roles click add new role click to select and deselect the settings you want to apply to your new role as desired, and then click create role for organization members to regain read write access to app data, enable access app data and modify app data in the app permissions as shown in the following graphic once you've created your role with read write access permissions, make sure to assign the role to your members as appropriate ( /#assigning roles to end users ) assigning roles to end users once you've created a role, designate them to the appropriate end users within your organization from settings > members , click invite member located on the right from the invite users modal that appears enter the email belonging to the end user you want to add click role and select the role type you want to assign click add to list when finished adding end users to the invite, click invite users viewing pending member invitations once a member is assigned a role, ditto automatically sends a formal invitation to the email address specified in the invite, which must be accepted before rbac privileges take effect to view a list of invitations waiting for approval, go to settings > members in the portal a complete list of invitations display within pending member invitations , as shown in the following graphic modifying and deleting roles to edit a role's settings or permanently remove a role from your organization from your organization, click settings click roles click the three dot menu next to the role you want to modify or delete to modify, select edit to permanently remove, select delete ditto employee access grants there are circumstances in which ditto's support team requires elevated privileges to access your app data, for instance, to troubleshoot an issue ditto employees can only access your app data with an approved access grant an access grant is a formal authorization provided by any of the following to approve the access request initiated by ditto current organization owner organization roles configured with manage access grants privileges once accepted, you can revoke access grants at any time (see /#revoking access ) for more information, see /#organization permissions settings and /#granting access granting access to approve a ditto initiated access grant click apps from access grants , click accept revoking access once an access grant is approved, you can end access at any time click apps from access grants , click revoke access