> For the complete documentation index, see [llms.txt](https://knowledgebase.fabricdata.com/studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.fabricdata.com/studio/admin-and-configuration/security/managing-access.md).

# Managing Access

### Managing Roles

**View All Roles**\
Navigate to **Security > Roles**. Each role shows:

* Policy Assignments (number) — click to see policies linked to this role in Access
* User Assignments (number) — click to see users with this role

**Create a Role**\
Security > Roles > Create Role → Name + optional description → Save

**Edit a Role**\
Security > Roles > Select role → Update name/description → Save

Renames propagate everywhere immediately.

**Delete a Role**\
Deletion blocked if:

* Role is assigned to any users → Unassign users first (Administration > Users)
* Role is linked to any policies in Access → Remove Access assignments first

Once cleared, select Delete.

***

### Managing Permission Groups

**View All Permission Groups**\
Navigate to **Security > Permission Groups**. Each group shows:

* Records assigned (count) — click to see titles in this group
* Policy Assignments (count) — click to see which policies link to this group in Access

**Create a Permission Group**\
Security > Permission Groups > Create Group → Name → Add records → Save

**Edit a Permission Group**\
Security > Permission Groups > Select group → Add/remove records → Save

**Delete a Permission Group**\
Deletion blocked if:

* Group is linked to any policies in Access → Remove Access assignments first
* If group has zero Access assignments: Group is deleted, but records remain (they may become inaccessible if not in other groups)

***

### Managing Policies

**View All Policies**\
Navigate to **Security > Policies**. The edit form shows if the policy is currently in use via Access (warning banner with count of affected assignments).

**Create a Policy**\
Security > Policies > Create Policy → Configure:

* **Actions:** Select CRUD permissions
* **Work Types:** Select one or more
* **Phases:** Select one or more
* **Data Groups:** Select one or more per work type
* **Locales:** Select one or more → Save

A policy must have at least one selection in each section.

**Edit a Policy**\
Security > Policies > Select policy → Update → Save

Changes take effect **immediately** for every user linked through this policy.

**Delete a Policy**\
Deletion blocked if policy has Access assignments. Remove assignments first via Security > Access, then delete.

***

### Managing Access Assignments

**View All Assignments**\
Navigate to **Security > Access**. Each row represents one assignment connecting a Role, Policy, and Permission Group.

The table shows:

* Policy (interactive link)
* Roles (interactive link)
* Permission Groups (interactive link)
* Work Types, Phases, CRUD Access (read-only, derived from policy)

**Create an Assignment**\
Security > Access > Create Assignment → Select Policy (single) → Select Roles (multi) → Select Permission Groups (multi) → Save

System creates one row per valid combination.

Assignments take effect immediately.

**Remove an Assignment**

* Single: Row actions menu > Remove Assignment > Confirm
* Bulk: Select rows > Bulk action toolbar > Remove Assignments > Confirm

Affected users immediately lose access granted exclusively through removed assignments.

**Edit an Assignment**\
Assignments cannot be edited. Remove and recreate to change.

**Search & Filter**

* Search: Policy Name, Role Name, Permission Group Name (substring match)
* Filter: By Policy, Roles, Permission Groups, Work Types, Phases, CRUD Access

Filter state persists across navigation.

***

### Auditing Access

**Question: "Which Policies does this Role have?"**\
Go to Security > Roles → Find role → "Policy Assignments" column → Click number → Access opens filtered by that role

**Question: "Which Roles have this Policy?"**\
Go to Security > Access → Filter "Policy" column to the policy → "Roles" column shows all

**Question: "Which Permission Groups does this Policy apply to?"**\
Go to Security > Access → Filter by Policy → "Permission Groups" column shows all

**Question: "Which Users have this Role?"**\
Go to Security > Roles → Find role → "User Assignments" column → Click number → Users screen opens filtered to that role

**Question: "Which Records are in this Permission Group?"**\
Go to Security > Permission Groups → Find group → "Record Assignments" column → Click number → Studio Library opens filtered to that group

**Question: "Where is this Permission Group used?"**\
Go to Security > Permission Groups → Find group → "Policy Assignments" column → Click number → Access opens filtered by that group

***

### Tips

* Combine search and column filters in Access to answer multi-dimensional questions like "Which Studio Library policies grant Update on Movies in Drafting?"
* Filter state persists across navigation—navigate away, come back, filters stay
* Renames to Policies, Roles, or Permission Groups propagate everywhere automatically (your audit trail won't break)