Roles and Access Control

Software Factory uses role-based access control to determine which organizations, projects, and modules a person can access and what they can do there.

Access has two separate layers:

1. Organization access determines whether someone belongs to an organization and whether they can administer it.
2. Project access determines which projects they can enter and what they can do inside each project.

Being an organization member does not automatically provide the same access to every project. A person can have different roles in different projects.

An organization Member uses a Full seat, can create projects, and can be assigned to individual projects. Their access inside each project is determined by their project role.

An organization View member uses a View seat and can access only the projects assigned to them. Their project role is capped at Viewer-level permissions: built-in Viewer or a Viewer-compatible custom role.

View members cannot create projects or receive Editor or Owner access. Viewer-level module exceptions still apply, so a View seat is not strictly read-only in every module. See View SeatsView Seats.

An organization Administrator uses a Full seat and can manage organization membership, invitations, role definitions, policies, billing, and organization-wide project administration.

Organization Administrators also receive Owner-equivalent authority in projects belonging to their organization.

Software Factory provides three built-in project roles:

Each role includes the level below it:

Owner includes Editor, and Editor includes Viewer.

Some modules intentionally include limited actions at Viewer level. For example, an Artifact Viewer can upload an artifact and a Feedback Viewer can submit feedback. See Permissions ReferencePermissions Reference for the complete map.

Organization Administrators can create reusable custom-role definitions for more precise project access.

A custom role combines:

• Base Project Access: No Access or Viewer.
• Module Access: No Access, Viewer, or Editor for each configurable module.
• Project assignment: the custom role is assigned to a person separately in each project.

For example, an organization could create a Requirements Reviewer role with No Access as its base, Requirements Viewer access, and no access to other modules.

Custom roles cannot grant general project ownership or organization administration.

Software Factory combines all applicable access granted to the person:

• Organization Administrator access, when applicable
• Their assigned built-in or custom project role
• Any project-role ceiling imposed by their organization seat type
• Module access included by that role
• Any narrower resource rules required by the feature

Permissions are additive. A role can raise access, but a custom role with Viewer as its base cannot reduce an individual module below Viewer.

When no applicable role grants an action, the action is denied.

A person may be able to enter a project while still lacking access to one or more modules. Those modules can appear locked and cannot be opened.

If a person follows a direct link to content they cannot access, Software Factory displays an access error rather than exposing the content.

If someone believes their access is incorrect, a Project Owner or Organization Administrator should check their project assignment and role definition.

Software Factory agents operate with the access of the user who starts or owns the action. An agent cannot use a module or perform an operation that the underlying user is not permitted to perform.

• Compare the built-in project rolesCompare the built-in project roles
• Create and manage custom rolesCreate and manage custom roles
• Review the complete permissions mapReview the complete permissions map
• Understand Full and View seatsUnderstand Full and View seats