User Roles

This document goes over the different user roles on the Agency Platform and the level of access each role has. A role defines a group of users that have certain privileges. Each role is assigned a specific set of permissions. Permissions control what users can do on the site. After reviewing this document the reader will be familiar with the different roles available and the capabilities that role provides.

User Roles and Permissions

Drupal has two basic roles, anonymous users and authenticated users. The State agency Drupal distribution adds four additional roles that an agency can assign to their users: Power user, Content editor, Content creator, and Restricted authenticated user. Finally, there are two special roles that are not available for assignment, but are used by the Digital Government program and select agencies who have a signed support agreement.

Anonymous user: This role is used for users that don’t have a user account or are not registered on the site. Anyone that visits a Drupal site is considered an anonymous user until they login. Any permission granted to the Anonymous user role can be used by any site visitor. A common example of a permission assigned to the Anonymous user role is “view published site content”. Without this permission an anonymous user would not be able to view your website.

Authenticated user: This role is automatically granted to all logged in (registered) users. Therefore, all permissions assigned to the authenticated user role will apply to all registered users.

Restricted authenticated user: The permissions assigned to this role vary by site. The restricted authenticated user typically does not have the ability to create, modify and publish content, or any of the permissions available to the other roles. This role is normally assigned to users who may need access to perform a limited set of functions, but not otherwise make changes to your website. A common example of a permission assigned to the Restricted authenticated user role is “view webform submissions”. This is useful when an accounting staff member needs to reconcile payment information with a form submission, but should not otherwise be able to make changes to your site.

Content Creator: The Content Creator role, formerly known as the contributor role, only has permission to create and edit their own content and cannot publish content, edit content created by others, or make any configuration changes to the system. This role is most often used to grant someone the ability to create content while requiring someone else to publish the content.

Content Editor: The Content Editor role, formerly known as just the editor role, can create, modify and publish content. This role is typically granted to people who are trusted to edit all content on a website and to publish that content to the public. While the Content Editor role can change all content on your website, they can not make system configuration changes or perform more powerful actions that run the risk of making your site unusable.

Power User: The Power User role is the most advanced role typically assigned to a user at an agency. In addition to all the permissions provided to the Content Editor and Content Creator roles, the Power User can make many system configuration changes including things that will change the appearance, structure and functionality of your site. This role is designed for agencies with technical staff capable of performing limited configuration changes to the site. While this role can not permanently damage your site, they do have permissions to make changes that might require support from our service desk to restore functionality. For this reason, prior to assigning the Power User role to a staff member, we recommend they attend one of our monthly Advanced training sessions.

Site Administrator: The Site Administrator role, formerly known as just the administrator role, has all of the permissions provided to the other three agency roles, plus several advanced permissions. This role is designed for agencies with advanced technical staff capable of performing technical configuration changes to the site. The Digital Government team has reviewed the current state of the agency platform, security concerns, and the costs of maintaining and supporting the platform. In order to continue offering the best possible service and control costs, we require all users who need to be granted the Site Administrator role to sign the Agency Platform Administrator Rights Policy and Agreement

Permission Chart

The Agency Platform II distribution has over 650 fine grained permissions that can be assigned to each role. While it is not practical to publish all permissions here, we have summarized the most common permissions your staff will likely need. No changes shall be made to the existing distribution permissions scheme without prior consultation with platform management. Site builders shall coordinate with platform management to ensure all new permissions are in alignment with our overall permission philosophy outlined in this document.

More detailed example of the permissions within the websites

Disclaimer

These materials are intended to assist State of Arizona employees, contractors, vendors and others as they strive to improve their knowledge and understanding of the Agency Platform II. While we attempt to thoroughly address specific topics, it is not possible to cover everything that is needed. This information must be understood as a tool for addressing information as much as we can. Over time, Agency Platform maintainers may modify rules and procedures in light of new technology, information, or circumstances.