If you are looking for how to invite or manage users: click here.
What is it
Groups and roles are a type of permission and access control to limit what users can do within the platform.
Who is it for
Typically a platform administrator or a tool-owner within a company is responsible for setting up groups and roles. Within the contractuo platform the user needs to be assigned ‘administrator’ in order to be able to create or change groups and roles.
Note: contractuo distinguishes between platform roles and user roles. A platform role is to be assigned when inviting a user. User roles are discussed in this section.
Overview of what you can limit
Creation of:Text-blocks
Templates
Dynamic fields
Forms
Blueprints for contacts
Contact fields
Organization fields
Shared Folders
GroupsFilling of:ProductsAccess to:Documents
Folders
Individual details
Organization details
Contact details
Dynamic fields
Products
Why would you limit access?
Limiting access prevents users seeing documents that they don’t need. As lots of documents contain highly sensitive information, it could be a smart way to protect these data. It also helps to give clarity to a user’s responsibilities and to focus on what he wants to accomplish with the platform.
What is a group and why use it?
The goal of creating a group is to assign a group of users the same kind of permissions on the platform at once instead of all one by one.
Roles that are created within a group inherit the settings of the group as basic settings. Specific adjustments can be made on role level.
Having groups also makes it easy to assign folders to multiple users at once.
Example: You as a manager have a question about the content of a document. You would like an answer as soon as possible, so you assign the task to the whole group of ‘Content Managers’.
What is a role and why use it?
The goal of creating roles within a group is to assign more specific permissions to users within that group. The role that is created in a group will inherit all group permissions by standard. More specific permissions can then be assigned.
The reason for creating more specificity is that it not only allows for more folder restrictions but also because tasks can be assigned to roles specifically (instead of to an entire group).
Example: An assistant would like to have a contract signed within 3 hours. Instead of assigning the task of signing this document to one specific manager, she assigns it to the role ‘Managers’. This means all the users that have the role ‘Managers’, (which in this case means they have the permission to sign), will get a notification of the task. More users getting the notification means a bigger chance that the document gets signed in time.
How to create a group
Important: Take the time and think about how the groups and roles must be set up to work the best for your company. It is possible to reorganize afterwards, but that takes time. We recommend to block enough time (min half a day) to think of the setup.
- Go to ‘Settings‘ in the outer bar and click on ‘Group, Roles and Permissions‘.
- Click on ‘New Group‘, give it a suitable name and save it.
- Repeat this step for every group that needs to be created.
- Click on the first group that has been created and assign the permissions that are needed by ticking the boxes. Save it.
- Repeat this step for every group.
How to create roles
- If you created groups and would like to create roles, click on ‘+ Add New Role‘ under the first group.
If you didn’t create groups and just want to work with roles, click on ‘+ Add New Role‘ under the group ‘Default‘. - Give the role a suitable name and save it.
- Repeat this step until you created all roles that are needed.
- If you created groups, go to the other groups and create roles the same way as described above.
- Click on the first role that you created. Tick all the boxes with permissions that are needed for this role (in addition to the group permissions).
- Repeat this step for all the roles that are created.
The next step is to invite users to the platform. Click here for instructions for inviting users.
How to assign roles
If the users created an account through your invitations, you will either receive a notification or an email. This depends on your settings. The next step is to assign user roles.
- Go to ‘Group, Roles and Permissions‘ and click ‘Assign Roles‘.
- You’ll find the list of users that created an account on the left. Click on the pencil-icon behind the name to edit the user’s groups and roles and platform role.
- Select a group if you haven’t done that when you invited the user or when you would like to change the group.
- Select the role for this user.
Note: a user can belong to multiple roles if that’s needed. - Select the platform role if you haven’t done that when you invited the user or when you would like to change this role.
- Click ‘Save‘ and repeat this for all users.
Examples of how to structure groups and roles
It could be helpful to look at an example before implementing the groups and roles to get an idea of the possibilities. In the following example we’ll pretend as if you’re a platform administrator of company A. We will give you instructions to implement the groups and roles for your hypothetical goal.
Example 1: Typical application of groups & roles when contractuo is used in a single department
Goal: To keep documents separated by role.
In this example we setup groups and roles along the structure of a company (this may differ in your case, but the example should make it clear that it follows company structure and roles). Typically you would want to do this when responsibilities are clearly split alongside roles. This may be the case for most companies with more than 250 employees but does not exclude smaller companies.
Let’s take the example of an HR department. Our example department has three roles:
- Head of HR
- HR business partner
- HR administrator
There are multiple HR business Partners:
- HR Business Partner Sales DACH
- HR Business Partner Sales BENELUX
- HR Business Partner Sales NORDICS
- HR Business Partner Operations
- HR Business Partner Technology
The head of HR would typically be allowed to see all documents whereas the HR business partners should maybe only be allowed to see the documents that are related to the employees within the section that they are responsible for. And finally, the HR admin is potentially tasked with setting up all the templates for employee contracts and bonus letters. But, he should not be allowed to see any of the documents that are related to employees.
How would you set this up in contractuo?
- Go to ‘Settings‘ in the outer sidebar and click ‘Group Roles and Permissions‘.
- Click on ‘New Group‘ and give it the name ‘HR‘.
- Click on ‘+ Add new role‘ under the group ‘HR‘ and give it the name ‘Head of HR‘.
- Also create a role for each HR Business Partner. Create a role for:
– HR Business Partner Sales DACH
– HR Business Partner Sales BENELUX
– HR Business Partner Sales NORDICS
– HR Business Partner Operations
– HR Business Partner Technology
– HR Administrator
Why are we creating different roles for the HR business Partners?
By creating different roles for the HR Business Partners, you can limit which folders they can see. You must actively setup the folders separately too. Click here to read how to.
Example 2: groups per region
Above is only an example for HR, but this would also apply to your sales organization. You could split them by region, by product or however it suits the structure of your organization the best.
Another example could be:
Group: Sales DACH
- Role: Sales Manager DACH
- Role: Account Manager DACH
- Role: Sales Desk DACH
Group: Sales BENELUX
- Role: Sales Manager BENELUX
- Role: Account Manager DACH
- Role: Sales Desk DACH
Group Sales NORDICS
- Role: Sales Manager BENELUX
- Role: Account Manager DACH
- Role: Sales Desk DACH
Example 3: groups by platform roles
Another way is to structure groups and roles in the way the employees will use the platform.
- Content managers will be responsible for the content of the documents. They will create templates, text blocks and smart fields.
- Users will fill in the templates
- Platform Administrators will manage the users and be responsible for the platform.
Group: Content Manager
- Role: Sales manager DACH
- Role: Sales desk DACH
- Role: Senior Sales DACH
Group: User
- Role: Assistant Sales Manager
- Role: Junior Sales
Group: Platform Administrator
- Role: Tool owner
- Role: User management and Security
Tip: These are just a few examples of how to structure an organization or a department. Please take time to decide what suits the best for your company/department.