User & Permission Management

Overview

User & Permission Management is the foundational security module of the platform, answering two core questions: "Who can log in to the system" and "What can they do after logging in." Through the combination of users, user groups, and roles, it implements flexible and controllable role-based access control (RBAC).

What This Module Can Do for You

• Manage login accounts: Create, edit, disable, and delete users; handle password resets and account lockouts
• Batch authorization: Group users into user groups and grant the same roles to an entire team at once, reducing repetitive operations
• Fine-grained permission assignment: Define "which menus are visible" and "what operations can be performed on which resources" through roles
• Meet compliance and audit requirements: Assign permissions by role rather than by individual — when personnel change, simply adjust roles, keeping responsibilities clear and traceable

Core Concepts: Users, User Groups, and Roles

Understanding the relationship between these three concepts is key to using this module effectively.

Concept	Purpose	Example
User	An account that can log in to the system, representing a specific person	Zhang San's account zhangsan
User Group	A collection of users for batch management by team or function	"Network Operations Group", "CMDB Administrators Group"
Role	A set of permissions that defines "what can be done"	"Read-only User", "CI Administrator"

How Permissions Take Effect

A user's effective permissions = permissions from roles directly assigned to the user + permissions from roles linked to their user groups. The two are combined as a union, with the "highest permission wins" principle applied.

• Direct authorization: Assign roles to a user on the user detail page, or conversely, add users to a role on the role detail page.
• Inherited authorization: Add a user to a user group, then link that user group to roles. The user "inherits" the permissions of those roles.

When to use user groups?

When multiple users need the same permissions (for example, the entire "Network Operations Group" needs to view CMDB), using user groups for batch authorization is much more efficient than assigning roles to each user individually. When employees join, transfer, or leave, simply adjust their user group membership, and permissions follow automatically.

Two Permission Dimensions

Each role contains two types of permissions that control "what you can see" and "what you can do":

Permission Type	Control Scope	Values
Menu Permission	Which menus appear in the left navigation after login	Enabled / Disabled
Resource Permission	Operations that can be performed on specific business resources (CIs, collection points, dashboards, etc.)	No Access / Read-only Access / Full Access

For the complete list of permission items, see Permissions Reference. If you want to know which permissions a specific functional module requires, see Permissions Required by Each Module.

Built-in Roles

The system provides two built-in roles out of the box, covering the two most common usage scenarios:

Built-in Role	Applicable Scenario	Permissions
administrator	Super user who needs all permissions	All menus visible, all resources full access
viewer	Users who only need to view data without making changes	All menus visible, all resources read-only access

note

Built-in roles are maintained by the system and cannot be deleted or edited. If you need a different combination of permissions, create a custom role.

Module Organization

User & Permission Management includes three sub-modules under the business tenant, each with a "list page + detail page" structure:

Sub-module	Documentation
User Management	User Management List · User Details
User Group Management	User Group Management
Role Management	Role Management List · Role Details

Differences Between System Tenant and Business Tenant

This module behaves differently depending on the tenant type. Please confirm your environment before use:

	Business Tenant	System Tenant
Navigation Menu	"User & Permission Management" with three sub-menus	"Platform User Management" with user management only
User Management	Full features (including roles, user group assignment)	Simplified features (basic account information only)
User Group Management	Available	Not available
Role Management	Available	Not available
Permission Assignment	Via roles and user groups	No role concept, simplified management

info

This documentation primarily covers the full features of the business tenant. If you are in the system tenant, you will not see user group and role content — this is expected.

Typical Workflows

Scenario 1: Onboarding a New Employee

1. (One-time) Create a role: Create a role as needed in Role Management (e.g., "Network Operations Engineer"), and configure its menu permissions and resource permissions
2. (Recommended) Use a user group: Create a user group in User Group Management (e.g., "Network Operations Group"), and link the role from the previous step to it
3. Create a user: Create a user account in User Management and add them to the user group from the previous step
4. The user can log in and see the corresponding menus and operate on the corresponding resources

Scenario 2: Adjusting an Employee's Permissions

• Temporary adjustment: Directly assign or revoke a role on the user detail page
• Batch adjustment: Adjust the roles linked to a user group — all users in the group will have their permissions updated synchronously

Scenario 3: Employee Departure

1. Find the user in User Management
2. Choose to Disable Account (retain account, prevent login) or Delete Account (permanently remove)
3. Business data created by the user is not affected, and creator records are preserved

Best Practices

• Prefer user group authorization: Even if there is only one or two people currently, it is recommended to assign roles through user groups for easier scaling
• Define roles by function: One role should correspond to one clear responsibility (e.g., "CI Maintenance", "Read-only Audit") — avoid creating "all-in-one" roles
• Principle of least privilege: When creating a new role, only select the necessary menus and resources, and gradually expand as needed
• Regular cleanup: Periodically review user group members and linked roles, and remove users who have left or transferred

Frequently Asked Questions

Q: What is the relationship between user group members and the "Associated Users" in the role detail page?

They are two views of the same data. "Role → Associated Users" lists all users who directly have that role; "User Group → Associated Roles" lists the roles that the group has. A user can be assigned a role directly or inherit roles through a user group.

Q: If a user is directly assigned a "Read-only" role and also inherits a "Full Access" role through a user group, what are their effective permissions?

The highest permission wins. A user receives the highest access level across all sources for a given resource, so the user will have full access to that resource.

Q: What is the difference between disabling and deleting a user?

• Disable: The account is retained but cannot log in. Suitable for leave, temporary suspension, and similar scenarios — can be re-enabled at any time
• Delete: The account is permanently removed and cannot be recovered. Suitable for departure scenarios where the account no longer needs to be retained. In either case, business data created by the user is not deleted