Roles and Permissions

As we roll out the UC 5.0 platform including PlantUML, Unified Dictionary, API Access and more, we will be putting in place an initial set of permission-based roles to manage access to the application functionality.

While we are still in the early stages, the goal is to create a small set of roles that could potentially expand as we learn more about customer usage.

Overview

For each of the initial areas: PlantUML, Dictionary, and Glossary we want to grant access in a consistent fashion across those areas with the following roles.

Owner - full access to account and community
Contributor - full access to account-owned documents, diagrams …
Reviewer - read and tag access to account (note: tagging or classifying will come later)
Reader - read access to account

In addition to the product-specific roles, there are two additional administrative roles:

Platform Administrator - manages access.
Billing Administrator - manages subscriptions and billing.

Note: when CCH and Mapper are added, additional roles may be added that focus on the approval process.

Product-specific Access

After analyzing the different jobs-to-be-done (JTBD), we identified the following access requirements:

Visibility: private, community, or both
Ownership: account-owned vs. not-account-owned or both
Actions: create, read, update, delete, tag, classify, comment …
Scope: specific object access (e.g., “glossary A”, “dictionary C”, “PlantUML Diagram 1” …)

Discussion topic: Many modern SaaS applications include collaboration aspects where users can individually grant access to specific documents, diagrams … for others to comment on or edit. How does scope and collaboration work together? Or are they the same thing?

PlantUML

PlantUML access need not have Scope defined for early access, but will likely be needed for GA.

Role	Description	Visibility	Ownership	Actions	Scope	Comments
PlantUML Owner	Access to all private and community diagrams	Private and Community	Account-owned and not-account-owned	All (create, update, delete, …)	All (any PlantUML diagram)
PlantUML Contributor	Access to all account-owned diagrams whether private or community	Private and Community	Account-owned only	All (create, update, delete, …)	All (any PlantUML diagram)
PlantUML Reviewer	Review access to all account-owned diagrams whether private or community	Private and Community	Account-owned only	Read and comment	All (any PlantUML diagram)	Their role-specific actions such as comment won’t be available early on which makes this role identical to “reader”
PlantUML Reader	Read access to all account-owned diagrams whether private or community	Private and Community	Account-owned only	Read	All (any PlantUML diagram)

Glossary

Glossary (as opposed to PlantUML and Dictionary) access must have Scope defined early on to ensure only specific users can access sensitive information.

Role	Description	Visibility	Ownership	Actions	Scope	Comments
Glossary Owner	Access to all private and community glossaries including search	Private and Community	Account-owned and not-account-owned	All Create and manage glossaries and manage a set of terms in those glossaries Manage access to each glossary Search third-party dictionaries	All (any glossary)	Must be able restrict access to specific glossaries to person, group or team (could start with users)
Glossary Contributor	Must be able access all account-owned glossaries whether private or community and search as long as have permission to access those glossaries	Private and Community	Account-owned only	Create, read, update, and delete terms within glossaries Search third-party dictionaries	Only those given access to
Glossary Reviewer	Must be able access all account-owned glossaries whether private or community as long as have permission to access those glossaries	Private and Community	Account-owned only	Read and comment on terms	Only those given access to	Their role-specific actions such as comment won’t be available early on which makes this role identical to “reader”
Glossary Reader	Must be able access all account-owned glossaries whether private or community as long as have permission to access those glossaries	Private and Community	Account-owned only	Read glossary terms	Only those given access to

Dictionary

Dictionary access need not have Scope defined for early access, but might be needed for GA. The hypothesis is that organizations will only have one dictionary that will be “federated” with the compliance dictionary for citation tagging for their private documents.

Role	Description	Visibility	Ownership	Actions	Scope	Comments
Dictionary Owner	Access to all private and community dictionaries including search	Private and Community	Account-owned and not-account-owned	All Create and manage a compliance dictionary and manage a set of terms in that dictionary Search third-party dictionaries	All (any dictionary)	We hypothesize that only one dictionary will be needed.
Dictionary Contributor	Must be able access all account-owned dictionaries whether private or community and search	Private and Community	Account-owned only	Create, read, update, and delete dictionary terms within a dictionary Search third-party dictionaries	All (any dictionary)
Dictionary Reviewer	Must be able access all account-owned dictionaries whether private or community	Private and Community	Account-owned only	Read and comment on terms	All (any dictionary)	Their role-specific actions such as comment won’t be available early on which makes this role identical to “reader”
Dictionary Reader	Must be able access all account-owned dictionaries whether private or community	Private and Community	Account-owned only	Read terms	All (any dictionary)

Administrative Roles

Regardless of the products subscribed to, administrators are required to set up the account and grant access to users.

Role

Description

Actions

Comments

Platform Administrator

Manages all IT Infrastructure including SaaS applications

Manage users (invite, revoke, remove …)

Billing Administrator

Manages all financial related topics including SaaS subscriptions

Choose and pay for subscription

Upgrade or downgrade existing subscription

Jobs to Be Done (JTBD)

Below are the identified jobs that need to be done with their respective permission-based roles.

PlantUML

Persona	Task Name	Situation	Motivations	Input	Output	Permission-Role
Compliance Katherine	Create and manage PlantUML Diagrams	When I document compliance processes	I want to create a repeatable process for the compliance team to easily follow	CCH content including CDOCs, audit questions … Community accessible PlantUML diagrams	Set of PlantUML diagrams	PlantUML Owner
Process Peter	Create and manage PlantUML Diagrams	When I document or review my organization's process	I want to assist my director in building repeatable compliance processes	CCH content including CDOCs, audit questions … Account-owned PlantUML diagrams created by others	Set of PlantUML diagrams	PlantUML Contributor
Analyst Alberta	Organize PlantUML Diagrams	When I review my superiors process diagrams	I want to help the team make compliance process diagrams easily accessed for others	Disorganized set of PlantUML diagrams	Organized set of PlantUML diagrams	PlantUML Reviewer
Doer Dan	Search for, review, and download PlantUML diagrams	When I help a team with a process that includes compliance steps	I want to make sure we do all the right steps the first time	Organized set of PlantUML diagrams	Set of files or hyperlinks updated on our SharePoint collaboration site	PlantUML Reader

Glossary

Persona	Task Name	Situation	Motivations	Input	Output	Permission-Role
Compliance Katherine	Create and manage corporate glossaries	When I define corporate policies	I want to ensure everyone in the company has a common understanding of the terms within our policy	Company policies	A set of glossaries and terms	Glossary Owner
Process Peter	Create and manage company glossaries	When I document or review my organization's policies	I want to assist my director in building repeatable compliance processes	Company policies	A set of glossaries and terms	Glossary Contributor
Analyst Alberta	Organize glossaries	When I review my superiors glossaries and terms	I want to help the team make company glossaires easily accessed for others	Disorganized set of glossaries and terms	Organized set of glossaries and terms	Glossary Reviewer
Doer Dan	Search for, review, and read glossary terms	When I help a team with any well-defined process	I want to make sure we do all the right steps the first time	Organized set of glossaries and terms	Set of files or hyperlinks updated on our SharePoint collaboration site	Glossary Reader
Employee Edgar	Review terms	When I read through a company policy document	I want ot make sure I understand the terms defined in the policy	A company glossary	An understanding of the terms	Glossary Reader

Dictionary

Persona	Task Name	Situation	Motivations	Input	Output	Permission-Role
Compliance Katherine	Create and manage a compliance dictionary	When I map in private policies	I want to map our policies to UCF's common controls	Company policies UCF tools	My organization's compliance dictionary with terms	Dictionary Owner
Process Peter	Create and manage a compliance dictionary	When I document or review my organization's policies	I want to assist my director in building repeatable compliance processes	Company policies UCF tools	My organization's compliance dictionary with terms	Dictionary Contributor
Analyst Alberta	Organize dictionaries	When I review my superiors dictionaries and tersm	I want to help the team make compliance dictionaries easily accessed for others	Disorganized set of dictionaries and terms	Organized set of dictionaries and terms	Dictionary Reviewer
Doer Dan	Search for, review, and read dictionary terms	When I help a team with a process that includes compliance steps	I want to make sure we do all the right steps the first time	Organized set of dictionaries and terms	Set of files or hyperlinks updated on our SharePoint collaboration site	Dictionary Reader

Personas

Note: these will be moved out to the persona pages

Persona	Title	Role
Compliance Katherine	Director of Compliance	Leads compliance team at fin-tech organization
Process Peter	Compliance Manager	Member of compliance team at fin-tech organization
Analyst Alberta	Compliance Analyst	Junior member of the compliance team
Doer Dan	Operations manager	Supports all business departments in their operational tasks
Employee Edgar	Any employee	Ay role