Restrict capabilities

Overview

The Restrict capabilities page allows for role-specific capabilities to be adjusted on a per-tenant level: capabilities are assigned on the site level at the first instance, and can then be removed selectively from the company level as desired (so that, for instance, a company manager in Company A will have a different set of capabilities than one in Company B, without needing to make any modifications to the default role). Capabilities in IOMAD are both context-aware and tenant-aware, so if a user exists in multiple companies with a different role in each, their respective capabilities will correspond to whatever changes (if any) have been defined for that company via the Restrict capabilities page.

Using company capability restrictions

To restrict capabilities for a given role within a given company:

Go to the IOMAD dashboard.
Choose the company you'd like to edit from the Select a company dropdown (or use the company selector at the top right of the page).
Click on the Companies tab.
Select Restrict capabilities.

Click the cog icon next to a role to adjust its capabilities. You'll then see a list of capabilities currently available to that role, which you can toggle off if desired. Clicking the Show IOMAD roles button will take you back to the previous page.

Role templates

A set of restrictions that have been applied to roles in this way can be saved as a role template. The template then serves as a shortcut to apply those same restrictions to other tenants.

Once you've made some changes to capabilities, click Save role template on the Restrict capabilities page to create a template. You'll be asked to give the template a name, which must be unique. The Manage role templates button on the Restrict capabilities page then allows you to modify or delete existing templates.

Note

Role template sets remain separate from the companies they have been applied to. They are simply copied to replace the current company settings meaning that both the company role restrictions and the template set restrictions can be later updated without any unexpected impact.