Role-Based Access Control in the Organization management

In terms of role-based access control in Organizational management, a Member is understood as a person who does not have an Organizational role. Their access level is limited to specific resources (folder, site, or dataset) to which they are invited within the Organization.

Role-Base Access Control on resources

There are two types of roles within an Organization: Organization-level roles and Role-Based Access Control-level in resources.

There are some ways in which Organization roles and Role-Based Access Control-level roles differ:

• Unlike Organizational roles, the highest role assigned within role-based access control is Manager.
• Organization users have always been granted access to all resources, but Members can only access the resources they are invited to.
• Organization-Level Roles and RBAC Inheritance: 
  • Organization-level roles (except for the Member role) are inherited by Role-Based Access Control (RBAC). When operating within the folder hierarchy, only upgrades to these inherited organizational user roles are permitted, and this capability is exclusive to Cloud Drive resources. Downgrades of these specific roles are not allowed in this context.
  • Member role access: The Member role within the organization allows an individual to be invited to collaborate on a specific Cloud Drive resource. Without such an invitation on a particular resource, a Member is not granted access to anything. Once invited, the access is provided directly on that resource. For this "Member" role, the access level can be both upgraded or downgraded as required by a Manager, and these modifications are performed within the Cloud Drive specifically via RBAC.

The current state comprises different roles at the Role-Based Access Control level:

• Manager: Full access to resource(s) and can manage Members.
• Editor: Can save measurements and create new folders, sites, and datasets.
• Reader: Can view folders, sites, and datasets without creation and edit rights.

Access type on resources

Inherited Organizational Access: Access inherited by the user's role within the Organization.

Access for these users cannot be deleted from resources. Access for these users must be managed or removed through the User management under the Organization management portal. 

Member at the Organization Level (Direct access): Members have been granted access to a specific resource via Role-Based Access Control.

From the Resource Access Management window, it is possible to increase or decrease the role of a member from the dropdown on that resource.

Member at the Organization Level (Inherit access): Members have been granted access to a different resource within the tree folder, and their inherited role on the current resource comes from a parent folder.

From the Resource Access Management window, it is possible to increase the role of a member from the dropdown on that resource.

The following graphic shows the relationship of Organization level roles and role inheritances to Role-Base Access Control in PIX4Dcloud Drive.

How to invite members to resources

1. Navigate to the folder, site, or dataset in Drive.
2. Click on the three-dot menu on the folder, site, or dataset.
   
3. Click Invite.
4. In Invite People, enter the email(s) of the Member(s) you want to invite to that resource and assign the roles.
   
5. Click Send invitation.

In Pending invitation, only invitations will be displayed to people who are not yet Members of the Organization.

How to upgrade roles inside resources

The steps to upgrade roles in resources are:

1. Navigate to the folder, site, or dataset in Drive.
2. Click on the three dots menu on the folder, Site, or dataset.
3. Click Invite.
4. Under User with Access, click the drop-down menu next to the email of the Member whose role should upgraded.
   
   

How to remove Members from resources

Members can only be removed from the resource they were invited to, and all inherited resource permissions will also be removed.

1. Navigate to the folder, site, or dataset in Drive.
2. Click on the three-dot menu on the folder, site, or dataset.
3. Click Invite.
4. Under User with Access, click the trash icon. 

How to remove Members from the Organization portal permanently

To delete permanently Members from the Organization:

1. Navigate to the folder, site, or dataset in Drive.
2. Click Invite.
3. Click Organization Portal.
   
   
4. Under User management, click the checkbox associated with the Member email that will be removed from the Organization.
5. (Optional) More than one Member can be removed from the Organization simultaneously.
6. Click Remove people.