Set organization and data permissions
Select the working organization first.
After this taskThe permitted operation completes; the denied operation causes no write.
Starting conditions and inputs
Have an authorized administrator and a separate staff test account.
Values for this task
entry_url, organization_id, member_ids, role_ids, allowed_operation, denied_operation, allowed_operation_url, denied_operation_url
Command sequence
open "$entry_url" && snapshot -i
click "$member_row" && snapshot -i
get text body
click "$role_picker" && snapshot -i
click "$role_option" && snapshot -i
get text body
# Outside browser: Prepare a separate session signed in as the test member.
open "$allowed_operation_url" && snapshot -i
get text body
open "$denied_operation_url" && snapshot -i
get text bodyRef targets and expected results
| # | Command / ref | Target and verification |
|---|---|---|
| 1 | click $member_row | Member record to change |
| 2 | get text | Compare member and organization IDs. |
| 3 | click $role_picker | Member role picker |
| 4 | click $role_option | Permitted role option |
| 5 | get text | Read stored role and organization scope. |
| 6 | Outside browser | Prepare a separate session signed in as the test member. |
| 7 | open | Page for an allowed member operation |
| 8 | get text | Read the permitted operation result. |
| 9 | open | Page for a denied member operation |
| 10 | get text | Read the denial and compare the source record for unintended writes. |
Check the result
The permitted operation completes; the denied operation causes no write.
Resuming after interruption
Read the same IDs again. Preserve correct settings and update only differences.
Choose the organization
Select the working organization first. Confirm which organization owns each new record. For example, give branch employees access to branch reservations without access to every customer at headquarters.
Assign staff roles
Open Members and check the organization, role, and active status. Use Roles to set which records the employee can read and change. Sign in as that employee to check access. A hidden menu alone does not prove that data access is denied.
Set the automation actor
The workflow owner determines its execution permissions. Review workflows when their owner leaves or changes role. A prompt cannot grant administrator permissions. Assign the required read and write access through the role.
Check allowed and denied actions
Use a test record to check an allowed read and edit. Then check that another organization’s records and unauthorized actions are denied. Record the account, organization, action, and result. Reduce excess permissions.