Permissions¶
Every area and every action in Lurana BPM is gated by a permission. Permissions are granted through Roles, and a role is assigned to a user in Users.
Areas¶
The top rail shows an area only when you have a permission that opens it.
| Area | Opens with |
|---|---|
| Designer | PM_FACTORY |
| Dashboard | DASHBOARDS |
| Admin | PM_SETUP or PM_USERS |
| Home | Any case permission; individual options such as Inbox are gated separately |
The sidebar follows the same rule: a section with no permitted option is not rendered at all, rather than showing an empty heading.
Opening the address of a protected area directly is refused, even when the menu entry is missing. Hiding a menu entry is convenience; the server is what enforces the permission.
Audit log and dashboards¶
These two shared surfaces have their own permissions, so an auditor does not need access to user administration.
| Surface | Permissions |
|---|---|
| Audit log | LURANA_AUDIT_LOG (area), LURANA_AUDIT_LOG_EXPLORER, LURANA_AUDIT_LOG_CASES, LURANA_AUDIT_LOG_PROCESSES, LURANA_AUDIT_LOG_REALTIME, LURANA_AUDIT_LOG_DEBUG |
| Dashboards | DASHBOARDS (area), DASHBOARDS_OVERVIEW, DASHBOARDS_USER_ANALYTICS, DASHBOARDS_CASE_ANALYTICS, DASHBOARDS_EVENT_ANALYTICS, DASHBOARDS_DOCUMENT_ANALYTICS, DASHBOARDS_EXECUTIVE, DASHBOARDS_MANAGER_DAILY, DASHBOARDS_MANAGER_PRODUCTIVITY, DASHBOARDS_PERSONAL |
Each dashboard appears only with its own permission, and its address returns an
access-denied page when opened without it. In the current Admin sidebar, Audit
Logs exposes Explorer and Emails; the Cases, Processes, Real-time, and
Debug permissions still exist but their entries are not shown. Removing
LURANA_AUDIT_LOG hides the whole Audit Logs section.
Case Tables¶
Case Tables permissions are granular, so a user can read data without changing it.
| Permission | Allows |
|---|---|
LURANA_CASE_TABLES |
Open the module |
| Table and domain permissions | View definitions, create, edit, delete |
| Data permissions | Read, insert, update, delete rows |
LURANA_CASE_TABLES_IMPORT / _EXPORT |
Import and export |
LURANA_CASE_TABLES_JOBS / _JOBS_CANCEL |
Run and cancel plans |
| AI permission | Use the copilot |
A read-only role sees the grid and its rows, but not Insert row, edit, delete, Import CSV, Export CSV, the copilot, or Delete domain.
How a permission change takes effect¶
Permissions are read when the session starts. After an administrator changes your role, sign in again to see the new menu.
Roles screen¶
In Admin → Users → Roles, the permission picker shows each permission with a readable name in the interface language and a type badge:
- Admin — administrative permissions.
- Core — current permissions.
- Plugin — permissions published by a plugin.
- Classic — permissions from the legacy interface.
- Deprecated — permissions kept for compatibility; avoid assigning them.
A permission that shows only its code, or a red badge, is a defect: report it.
Related¶
- Roles — creating roles and assigning permissions.
- Users — assigning a role to a user.
- Audit events — what the audit log records.
- Navigation — how the filtered rail looks.