Update DPT Permissions/Roles

Request from Angela Gisselman for DPT-PHX program and DPT-PHX Workflow to create roles where she can have an “assistant chair” and a “second screener” with different levels of access to their bins and review forms.

Steps taken:

1. Created two new custom permissions to use for implementing the requested access/abilities:

   1. Bins: DPT Assistant Chair

   2. Review Forms: DPT Chair

2. To control what bins are viewable in the DPT-PHX workflow, I updated the “read” custom permission for bins group: Application Review, as follows.

3. To control which forms are viewable (and therefore available to fill out and submit), I then added filters to the review forms as configured in the Workflow to restrict access by custom permission.

   1. The role of “assistant chair” will now be able to view bins that have forms attached they may or may not be allowed to submit; technically they can’t submit a form without adding it to their queue/having it assigned anyway, however since users can add files to their own queues (sometimes accidentally) preventing visibility of the form seemed worth it (plus I recently learned how to do this so might as well try it out).

   2. The forms in bins that we want to restrict should only be submitted by the Chair, so I created the custom permission of “Review Form: DPT Chair” to accomplish this. I wanted to use a custom permission, rather than filtering on role (which is possible), because permissions can become so layered and complex that I wanted to keep consistent with “access to objects is restricted by custom permission” as much as possible. Unfortunately, when testing, I couldn’t get the filters configured right using permission, so had to use role. will post in forum to see if it is possible.

   3. To do this, go into Workflows > Edit Workflow > DPT-PHX Application Review > Review Forms and then edit. Open each form that you want to permission/restrict and apply a subquery filter:

      Open

      

       

      1. Remember to refresh the configurable joins library after you add any new custom permissions/roles so they are available to filter.

      2. I learned this in a webinar where they said to use the “lookup” table when it is available because that was “best practice” (although hilarously no one could articulate why in the webinar, including Technolutions staff).

      3. Found this follow up post in forums: https://knowledge.technolutions.com/hc/en-us/community/posts/17874548946843-Workflows-Permissions-Conversation-Follow-Up?page=1#community_comment_19013104779547

      4. If you have more than one bin associated with a form, Slate is going to link them together. This was fine until I needed to add these filters, so I ended up unlinking the bins in the Review Forms tool so I could sometimes restrict by filter and sometimes not.

      5. I didn’t add this filter to any form that was in a bin that was already only viewable by the Chair, per the custom permission configurations.

4. Next I updated the existing Roles to add/update the custom permissions to align with this new plan.

   1. These roles are specifically configured to population-aware roles and assigned via the Populations tool in User permissions, so the “umbrella” over all these permissions and custom permissions within the Role is access to the application-scoped population of “Permission: DPT-PHX Application.”