Using Permission Sets: Unit & Feature Grants

Permission sets let you compose the permissions a title needs by dragging them into it. They usually come in two flavors: granting permission to units, or granting permission to features.

For example:

• Ban Members — this could mean one of two things. Either it grants permission to create a ban case and nothing else (no reading the case or anything around it), or it grants banning plus the things around it: browsing those cases, handling appeals from them, and managing resources within ban cases.
• Case Appeal Reviewer — likewise. It might grant only reading appeals, or — if it covers a whole feature — reading the appeals, reading the cases they originate from, managing the appeal (e.g. changing its state), accessing its resources, and creating a verdict.

Unit grants

Unit grants target very specific things, and are usually a single pre-defined permission node. For example, “Read Case Files” gives access to reading files in any type of case — but not to reading the cases that contain those files, which is itself required to even see the files.

You’d then complement it with another unit grant, such as “Read Cases” (read any case type). You can be even more specific: “Read Ban Cases” lets you read only ban cases, which you could compose with “Read Timeout Cases”, and so on, to limit which case types (and the files within them) someone can read.

Potential side-effect

With unit grants you may not grant all the necessary permissions, so a user might not get everything you intended — or a grant may be redundant because the unit lives “inside” another feature that requires a different permission.

Feature grants

A feature grant provides a single set that grants permissions to a logical group of units, or a whole feature. The “Ban Members” and “Case Appeal Reviewer” examples above are typical feature grants: they grant the main thing (ban a member, see an appeal) plus the complementary permissions you need around it.

Potential side-effect

Because feature grants give access to several things at once, you might grant more than you intended. To get tighter control, use multiple unit grants instead, or ask staff to set you up with some custom permissions.