Roles¶

Roles define what a user is allowed to do in Credence.

They represent responsibility, not just access. A well-designed role structure helps teams move faster while preserving controls around approvals, edits, and sensitive actions.

What a Role Controls¶

A role controls capability such as:

• view-only access
• create and edit privileges
• approval and workflow actions
• administrative actions for specific business areas

Roles do not decide which records a user can see by themselves. Record visibility is based on the user's portfolio/property access.

How Roles Are Applied¶

Roles are assigned at a portfolio level.

This allows the same person to hold different responsibilities in different portfolios.

Example¶

A user may be:

• Full Edit capabilities in Portfolio A (active role responsibility)
• View-only capabilities in Portfolio B (passive role responsibility such as viewing reports, but no edits)

This avoids creating separate user accounts just to handle different roles.

How Roles and Permission Groups Work Together¶

Permission Groups are reusable capability bundles attached to roles (see Permission Groups).

At a high level:

1. Create a role for your team.
2. Map permission groups to that role.
3. Assign the role in the relevant portfolio context.

If a user has multiple applicable roles in the same portfolio, capabilities are combined.

How Roles Relate to Record Access¶

Think of access as two checks:

1. Can this user access this record? (scope)
2. If yes, what can this user do with it? (role capability)

Roles answer the second question.

Role Design¶

Your team defines roles and maps permission groups to match your operating model. Credence can provide role templates and recommends least privilege and separation of duties where team composition allows. Limit administrative rights to a small set of users and review assignments regularly.

See Permission Groups for the group bundles behind each pattern, and the Permission Catalog for what each permission allows.

Governance Notes¶

• Treat role assignment changes as governance decisions, not routine form edits.
• Use periodic access reviews to confirm users still need each role.
• Review the Access Matrix report to see permanent and delegated portfolio access together.

Role Delegation¶

For temporary delegation of role capabilities to another user, see Role Delegation. Delegation is self-service on the delegator's own profile and does not replace permanent role administration.