Role-Based Access Control in the Organization management

This article explains how Role-Based Access Control works within Organization management.

In terms of role-based access control in Organizational management, a Member is understood as a person who does not have an Organizational role. Their access level is limited to specific resources (folder, site, or dataset) to which they are invited within the Organization.

Role-Base Access Control on resources

There are two types of roles within an Organization: Organization-level roles and Role-Based Access Control-level in resources.

There are some ways in which Organization roles and Role-Based Access Control-level roles differ:

• Unlike Organizational roles, the highest role assigned within role-based access control is Manager.
• Organization users have always been granted access to all resources, but Members can only access the resources they are invited to.
• At the Organization level, user roles can be upgraded or downgraded indistinctly. However, at the Role-Based Access Control level, only the role assigned to a Member can be upgraded inside the folder hierarchy. 

The current state comprises different roles at the Role-Based Access Control level:

• Manager: Full access to resource(s) and can manage Members.
• Editor: Can save measurements and create new folders, sites, and datasets.
• Reader: Can view folders, sites, and datasets without creation and edit rights.

Access type on resources

Inherited Organizational Access: Access inherited by the user's role within the Organization.

Access for these users cannot be deleted from resources. Access for these users must be managed or removed through the User management under the Organization management portal. 

Member at the Organization Level (Direct access): Members have been granted access to a specific resource via Role-Based Access Control.

From the Resource Access Management window, it is possible to increase or decrease the role of a member from the dropdown on that resource.

Member at the Organization Level (Inherit access): Members have been granted access to a different resource within the tree folder, and their inherited role on the current resource comes from a parent folder.

From the Resource Access Management window, it is possible to increase the role of a member from the dropdown on that resource.

The following graphic shows the relationship of Organization level roles and role inheritances to Role-Base Access Control in PIX4Dcloud Drive.

The table explains access to different resources based on the user's role at the Organization and Role-Base Access Control levels. It also shows whether roles can be upgraded or downgraded.

* Users invited to PIX4Dcloud Drive resources with direct access roles will automatically become Members of the organization if they are not already.

** If a resource has child items organized in a tree structure, any user with a direct access role on the parent resource will automatically have that same role inherited for the child items.

How to invite members to resources

1. Navigate to the folder, site, or dataset in Drive.
2. Click on the three-dot menu on the folder, site, or dataset.
   
3. Click Invite.
4. In Invite People, enter the email(s) of the Member(s) you want to invite to that resource and assign the roles.
   
5. Click Send invitation.

In Pending invitation, only invitations will be displayed to people who are not yet Members of the Organization.

How to upgrade roles inside resources

The steps to upgrade roles in resources are:

1. Navigate to the folder, site, or dataset in Drive.
2. Click on the three dots menu on the folder, Site, or dataset.
3. Click Invite.
4. Under User with Access, click the drop-down menu next to the email of the Member whose role should upgraded.
   
   

How to remove Members from resources

Members can only be removed from the resource they were invited to, and all inherited resource permissions will also be removed.

1. Navigate to the folder, site, or dataset in Drive.
2. Click on the three-dot menu on the folder, site, or dataset.
3. Click Invite.
4. Under User with Access, click the trash icon. 

How to remove Members from the Organization portal permanently

To delete permanently Members from the Organization:

1. Navigate to the folder, site, or dataset in Drive.
2. Click Invite.
3. Click Organization Portal.
   
   
4. Under User management, click the checkbox associated with the Member email that will be removed from the Organization.
5. (Optional) More than one Member can be removed from the Organization simultaneously.
6. Click Remove people.