Practical examples
Practical examples
Setting permissions to a new user
When new user is created it is by default without permissions. The concept of setting permissions is granting only needed permissions to new user and not granting all permissions and then revoking permissions. When granting specific permissions, in this case explicit permissions are set to a user, other nondefined permissions can therefore be acquired from a group or inherited from parent authorisation. If done othervise, granting all permissions and then revoking them, acquiring permissions from group is not effective because they are already explicitly set.
If users only needs permission for Orders, then it is sufficient to add permissions for Orders. On a click 
permissions are set default to full. Also all child authorizations of Orders are set default to full.
- See description of Apply button.
All child authorizations of Orders then also inherit full permissions. Checkbox inherited appears. Permissions are also defined. If permission for Change Sale Price had been previously explicitly set to specific permission, then it does not inherit permissions from parent authorization. The same applies to acquireing permissions from a group.
User and group permissions
In companies with multiple departments (Sales, Finance, Marketing, etc.), Pantheon users are usually (should be) placed in groups. Group can also be given specific permissions.
Adding user to a group on a user level:
Adding user to a group on a group level:
Group has defined permissions Read for Orders:
User has undefined permissions for orders. Permissions are not explicitly set:
After user becomes a member of a group, it acquires all permissions from a group that are not explicitly defined at a user level. In this case user acquires permission read for orders. If permissions for orders on user level are explicitly set, then user would not acquire permissions from a group. Explicitly set permissions at user level take precedence over permissions set at group level and are therefore not acquired. User can also be a member of multiple groups and in case it has no explicit permissions, it will acquire the highest permission from a group.
Copying permissions
1. Copying permissions can be done on authorization level for current authorization and all child authorizations. In this case only authorizations are copied, but not document types, statuses and registers.
Copy does not affect this level of authorizations:
- Item categories
- Cost center
- Subject types
- Departments
- Warehouses
- Chart of accounts
- Bank statements
- Automatic posting templates
- Financial reports
- Dashboards
- Dashboard components
- Pantheon applets
- Reports
Copying document types, statuses and registers can be done only for specific document type, statuses and register, other permissions will not be copied.
Example: copying permissins of parent authorization Subjects will not copy child permissions of warehouses and departments. For copying permissions of warehouses and departments from other user/group you need to navigate to warehouses or departmenst authorization and copy permissions.
2. Copying all permissions: authorizations, document types, statuses and registers from another user or group can be done on security level of user. Copying permissions can be done with checkbox membership or not. If copying only with checkbox permissions, then only user permissions are copied, if also membership checkbox is enabled, then also membership is copied and permissions from a group.
Permissions and memberships can also be copied to another user on different databse on the same sql server instance. The same user and groupname must exist on another database in order for copying is successful. Multiple selection is possible with use of shift or ctrl keyboard button. When checkbox "Permissions" is enabled, only user permissions are copied (permissions that are explicitly set on a user), permissions that user aquires from usergroup are not copied. If ckeckbox membership is enabled Group permissions are also copied. If group on target database does not exist, membership is not copied. Databases must be upgraded on the same version.
