Description
As an: team owner
I want to: add a user to my team with 'no-access' as their team-level role
So that: I can use Granular RBAC to selectively enable access to applications, and not worry about them defaulting to having access if new applications are created
A usability gap has been identified with our Granular RBAC capability by customers:
A team contains multiple applications, each hosting its own dashboard. The team owner wants to provide access it certain dashboards for certain users. They can achieve that today by:
- adding the user to the team
- use Granular RBAC to customise the level of access on each application
If they create a new application, all users will default to having access until the granular RBAC settings are updated for each user to remove their access. This is a particular problem when the granular RBAC is managed by SSO groups; the user's RBAC settings are only updated when they log out and back in. So the user gains access to the new applications by default until they log out/in.
The proposal here is to introduce a new team-level role that is lower than 'dashboard' that blocks access to by default.
Adding a user to a team with no-access level will show them a placeholder similar to the dashboard user role - and only list dashboards that granular-rbac allows them to see.
Requested by
Description
As an: team owner
I want to: add a user to my team with 'no-access' as their team-level role
So that: I can use Granular RBAC to selectively enable access to applications, and not worry about them defaulting to having access if new applications are created
A usability gap has been identified with our Granular RBAC capability by customers:
A team contains multiple applications, each hosting its own dashboard. The team owner wants to provide access it certain dashboards for certain users. They can achieve that today by:
If they create a new application, all users will default to having access until the granular RBAC settings are updated for each user to remove their access. This is a particular problem when the granular RBAC is managed by SSO groups; the user's RBAC settings are only updated when they log out and back in. So the user gains access to the new applications by default until they log out/in.
The proposal here is to introduce a new team-level role that is lower than 'dashboard' that blocks access to by default.
Adding a user to a team with no-access level will show them a placeholder similar to the
dashboarduser role - and only list dashboards that granular-rbac allows them to see.Requested by