Custom roles [Campus]

error_outline Only administrators can perform this action. We would recommend first testing this feature on the stage environment and then confirming if we can enable it in the production environment.

For each level within the Ans application, Ans provides different base roles. The authorisations of the base roles cannot be changed. Ans provides the following base roles:

• School level
  Administrator, Department administrator, Staff and Repro

• Course level
  Instructor, Invigilator and Reviewer

• Question bank level
  Publisher and Author

The base roles determine the range of the authorisation within the levels of the application. A user with the administrator role has access to all courses within a school, where a user with the staff role only has access to the courses where this users is added to. One of base roles per level is considered the default role. The default role is the role which is assigned in case the user is creating entities within Ans. For example, if a user with a staff role is creating a course, the default role on course level is set. At this moment, the default role for courses is instructor.

Next to the base roles in Ans, there is the option to add custom roles to the platform. This gives you the benefit of adjusting the access and functionalities for different types of users within the platform. The custom roles are based on the base roles within Ans. This means that the base role determines which hierarchical level in the platform the user is allocated to. For example, if you create a role that is based on the administrator role, the new role will have access to the whole school interface. The exact definition of what can be accessed by the new role is defined by using the toggle options in the custom role menu. The custom role always restricts access compared to the base role. In general, the base role can do everything on the hierarchical level in the platform to which the role is allocated, and the custom role will have less access as toggles will restrict certain functionalities. With custom roles, you can also change the default role to another role.

Tips before you create new roles

Before getting started, please take the following into account.

• Determine the hierarchical level
  Before you start thinking about what a new role can or cannot do, first think about which part of the platform the role should have access to. For example, should the new role be able to see the whole department? Or should it be a course role, which results in adding the user per relevant course?
• Without view rights, no action is possible
  Most access options have a 'view' toggle. If a view toggle is turned off, this means that the user cannot see the particular option via the interface. This implies that the user can also not create, edit or delete that option. We explicitly mention the interface here, as it is still possible to create, edit and delete via the API if viewing is disabled, but creating, editing and deleting are enabled.
• Combine access options to restrict access to interfaces as a whole
  It might be possible that some interfaces are disabled for users which is caused by a combination of access options. For example, in a test, you have the menu option 'Digital test' (or any other assignment type). Within a digital test, you have four submenus: Exercises, Grading Scheme, Objectives and Flow. If you create a custom role which has no viewing rights to all four submenus, Ans will disable access to the tab 'Digital test' as a whole. Despite the fact that 'Digital test' is not a separate access option within the custom role menu. This means you can manage to disable access to certain features by combining access options.
• Combine custom roles with employee privileges
  Next to custom roles, Ans also has employee privileges. Employee privileges might overlap with custom roles. In the future, employee privileges might be merged into custom roles. For now, as long as these options are both present in the platform, you will need to take into account that these settings can influence each other. It might be possible that you create a custom role with conflicting access compared to the settings in employee privileges. For example, the option 'Create assignments' can be turned off in employee privileges and it can be turned on in the custom role. For security reasons, Ans will deal with these situations by following the 'least access' principle. Ans will always restrict access if one of the two settings will not allow the user to create assignments. If you want to allow users to create assignments, both employee privileges and the custom role must allow this. This principle applies to all settings with can be set in both custom roles and employee privileges.
• Determine what is the default role per level is
  In the custom roles menu, you can set the default role for each level (school, course and question bank). As explained above, the default role is assigned to a user if the user creates a new attribute under which the default role is set. For example, if you set the role 'reviewer' as default role under courses, users that create a new course will automatically be assigned the role reviewer. 
• Determine if and which base roles you want to use
  Ans provides the possibility to disable and enable base base roles. This allows more freedom in setting custom roles for your school without having to use the base roles Ans provides. Before getting started, you should consider whether all base roles are necessary. Disabling a base role will disallow you to assign that role to a user.