Workspace Administration
Roles & permissions
Configure role rules with namespace:action permissions and filter-scoped access.
Roles & permissions
Roles control what users can do in Antly. Permission rules use namespace and action concepts, commonly shaped as namespace:action, and can be scoped by filters so a user can access only the records that match a business rule.
Permission model
| Part | Meaning | Example |
|---|---|---|
| Namespace | The model or controller being protected. | objects.Object, tickets.Ticket, system.User |
| Action | The intent or consequence the user can run. | retrieve, create, update, delete, consequence.invokeQuickAction |
| Filter scope | Optional data constraint applied to the permission. | Own department, assigned team, customer account, active records only. |
| Role | A named bundle of permission rules. | Support Agent, Finance Admin, Portal Manager. |
Configure roles
- List the job functions that need different access.
- Start from retrieve access, then add create, update, delete, and consequence actions only where needed.
- Use filter-scoped permissions for regional, departmental, customer, or team ownership rules.
- Assign users to roles and teams deliberately.
- Test with a least-privilege account and verify menu visibility, record lists, actions, reports, and portal access.
Operating guidance
Keep roles small and named after jobs, not people. When a user cannot see data, check menu placement, app enablement, object settings, and role filters before changing broad permissions. When a user can do too much, remove delete and consequence permissions first, then narrow update scopes.