Roles
What are roles?¶
Roles identify types or groups of users who perform similar tasks and therefore need to access specific functions or data. Each role contains a list of functions or operations that users associated with that role can perform. For example, a role can be associated with running specific data processing.
Types of role¶
There are the following types of role:
| Roles | Characteristics |
|---|---|
| System roles | - Predefined, cannot be changed or deleted. - Can be used as reference for creating custom roles. - Are identified by the $ symbol. |
| Custom roles | Created for specific needs, can be changed and deleted. |
System roles¶
The available system roles depend on the type of licence installed. A list is included below:
| Name | Description | Licence requested |
|---|---|---|
| $ALL | Can access all functions | Administrator |
| $ADMINISTRATOR | Has administrator privileges for an application database and can: - add new users - define Cash Flow Planning, Allocation and Closing, consolidation, ETL rules - apply the data entry and report generation settings - define the reporting forms and templates - configure the data collection process - prepare preliminary data prior to data entry (e.g. insertion of exchange rates and tax rates) Original data cannot be added. | Administrator |
| $AUDIT | Can view data and lists without editing them. | Data Entry & Reporting o Viewer |
| $CONSOLIDATOR | Has consolidator privileges and can: - enter data into the consolidated financial statements (e.g. consolidation adjustments, consolidation data processing) - enter data on shareholdings - manage intercompany entries - monitor the activities of individual contributors | Administrator or Power User or Contributor |
| $SYSADMIN | Has system administrator privileges, works only on the Repository and can: - create custom roles - add users and define their roles - manage user visibility on the application databases - manage data processing run modes and scheduling - manage database imports and exports - manage logs | Administrator |
| $USER | Has contributor privileges and, for the entities for which they are responsible, can: - enter data on balances and preconsolidation adjustments - enter data from forms - enter data on intercompany entries - reconcile intercompany entries - run data processing operations for individual companies - run the diagnostic check, by company - certify data | Power User or Contributor |
| $DEREPORT | Can generate reports, enter data from forms and run data processing operations entered on data entry forms or configured in a process workflow. | Data Entry & Reporting or Contributor |
| $ANALYTICS | Can see reports published on the Tagetik Analytics web portal according to their own rights. Cannot access the web interface. | Tagetik Analytics |
Functions and function modules¶
Specific functions are associated with every role, acting as authorisations to perform specific operations. Users associated with a role are authorised to perform all the functions that are in turn enabled for that role. Several related functions can be grouped into a module. Therefore, every function allows data to be worked on in a specific, controlled and restricted way.
Type of change to data¶
Below is a list of the possible data work permitted by the various functions:
| Type | Description |
|---|---|
| Don't edit data | Prevents data from being edited. |
| Consolidated amount | Allows editiing of tables of consolidated data, both for balances and for adjustments. |
| Adjustment | Allows editing of adjustment data tables, both gross and intercompany. |
| IC amount | Allows editing of tables of original intercompany data. |
| Gross amount | Allows editing of tables of original gross data. |
| All | Allows editing of data in more than one of the tables specified above. This function does not necessarily fall within one of the above classifications/ |
Association of roles with users¶
Associating a role with a user determines which menus the user can see and which functions they can perform. Users who have access to various application databases may have different roles for each database. When these associations are created, the activities to which the user will have access in the application database will also be defined. More specific restrictions are defined in the application database itself.
Example of association: different roles for different databases
USER1 needs to work on application databases DB1 and DB2. On DB1 he performs the function associated with role RA, while on DB2 he performs the functions associated with role RB. Roles and databases must therefore be associated with the user as follows:
| User | Application database | Role |
|---|---|---|
| USER1 | DB1 | RA |
| USER1 | DB2 | RB |
Example of association: different roles for the same database
USER2 needs to perform functions on DB2. These functions are associated with roles RC, RD and RE. The user must therefore be associated with all the necessary roles.
| User | Application database | Role |
|---|---|---|
| USER2 | DB2 | RC |
| USER2 | DB2 | RD |
| USER2 | DB2 | RE |
Restrictions on application databases¶
The types of restrictions that can be associated with a user in relation to specific roles that they perform on specific databases are outlined below. The relative user rights will consequently be configured by the system in the application environment.
| Restriction | Description |
|---|---|
| Unrestricted | Unrestricted user |
| Restricted on all dimensions | User restricted on all dimensions |
| Restricted | User only restricted for the entity, category and consolidation scenario dimensions |