# Part 1 · Roles

## 1.1 Giving someone a role

**Who** · `Admin` · someone whose role may give people roles.

**Where** · **People** › the person › **Change roles** beside "Roles in …".

**Before you start** · Nothing.

**The steps**
1. Tick the roles they should hold; untick the ones they shouldn't. Only roles that give nothing beyond your own access
   are listed.
2. Press **Save roles**.

**What the record shows** · The audit log keeps what their roles were and what they are.

**Who is told** · Nobody yet; notices come later.

**What can go wrong**
- *There's no "Change roles" on my own page.* Nobody changes their own roles: ask someone else.
- *There's no "Change roles" on the Owner's page.* They hold more than you do.
- *They hold a role I can't see in the list.* It gives more than you hold, so it is kept as it is (the page says so).

## 1.2 Making a role

**Who** · `Admin` · someone whose role may make and change roles.

**Where** · **Roles** › **New role**.

**Before you start** · A name nobody else in the workspace uses.

**The steps**
1. Name it, and say in a line what it's for.
2. Choose a role to start from (its permissions, as far as your own access), or nothing.
3. Press **New role**. Its page opens: tick what it can do (1.3).

**What the record shows** · The audit log keeps the new role and what it gives.

**Who is told** · Nobody.

**What can go wrong**
- *"Another role already has that name."* Choose another; capitals don't make a name different.

## 1.3 Changing what a role can do

**Who** · `Admin`.

**Where** · **Roles** › the role.

**Before you start** · Nothing.

**The steps**
1. Rename it or change its line, if you like.
2. Tick or untick its permissions. Only the ones you hold are listed; anything else it holds stays as it is.
3. Press **Save changes**.

**What the record shows** · The audit log keeps what it gave before and after.

**Who is told** · Nobody.

**What can go wrong**
- *A permission marked "runs the workspace" won't save.* Only someone who may give roles that run the workspace (the
  Owner) ticks those.

## 1.4 Why a permission isn't listed, or a role opens only to read

**Who** · Anyone who opens **Roles**.

**Where** · A role's page.

**Before you start** · Nothing.

**The steps** · Read the note beside the role:

| You see | It means |
|---|---|
| *You hold this role, so it opens to read* | Nobody changes their own access. Someone else can |
| *The account holder's role holds everything* | The Owner's role is renamed, never changed; it moves only when ownership is handed over |
| *Your roles don't include changing roles* | You may see roles, not change them |
| A permission missing from the boxes | You don't hold it, so you can't give it. The role keeps it if it had it |

**What the record shows** · Nothing.

**Who is told** · Nobody.

**What can go wrong**
- *I need to give a permission I don't hold.* Ask the Owner, or someone who holds it.

## 1.5 Handing over ownership

**Who** · `Owner`.

**Where** · **Roles** › the Owner role › **Hand over ownership**.

**Before you start** · The person taking it is active in the workspace.

**The steps**
1. Choose who takes it, and the role you keep (the default role if you choose none).
2. Press **Hand over**, read, and confirm. It happens at once.

**What the record shows** · The audit log keeps who handed it to whom.

**Who is told** · Nobody yet; notices come later.

**What can go wrong**
- *I can't get it back.* Only the new Owner can hand it back.

## 1.6 The standard roles (Service)

**Who** · `Service`.

**Where** · **Standard roles** in the menu.

**Before you start** · Nothing.

**The steps** · Read the roles every workspace starts with and what each gives. A workspace renames them and makes its
own; changing the standard set is a code change (`StandardRoles`) with `php artisan roles:sync`.

**What the record shows** · Nothing.

**Who is told** · Nobody.

**What can go wrong**
- *A workspace's Admin role differs from this.* After it was made, the workspace changed it: that's theirs.