On this page0
Guide
Roles, groups and permissions
Understand how access works in Zonitix, then shape it: build a role, put people in a group, require MFA for a group, and make one-off exceptions.
Before you start
- An administrator account. Roles, groups and “Access Control” sit under “ADMINISTRATION” in the left menu, and only appear if your role allows them.
- A group’s MFA setting can only be changed by someone who can also manage Security Settings.
- To see which roles your own account has, open “My Profile” at the bottom of the left menu and read “System Roles & Scope Access”.
The three pieces, in plain words
A permission is one thing a person may do, such as see users or approve an invoice.
A role is a named bundle of permissions. You give a role to a person directly, or attach it to a group.
A group is a set of people. When a role is attached to a group, everyone in the group holds that role. A group can also require its members to use MFA.
What someone can do is everything their own roles and their groups’ roles add up to, plus any one-off grants.
What your instance starts with
Seven groups: “Everyone” (every active person is added automatically and gets the basics: dashboard, org chart, the referrals portal and requesting access), “IT”, “Finance”, “Human Resources”, “HR Managers”, “Manager”, and “Security & Compliance”. “IT”, “Finance” and “Security & Compliance” require MFA from the start.
Nineteen built-in roles, listed on the Roles page in lower case with underscores, for example “administrator”, “standard_user”, “hr_manager” and “finance_approver”. One of the nineteen belongs to an optional add-on and is not described in these pages, so the reference lists eighteen. Most team groups come with a role already attached, so putting someone in the right group is usually all you need.
The “Manager” group works across the whole organisation. Its members can approve any access request and any Manager step in a workflow, not only those of their own reports, and can decide the access-review items assigned to them. Being someone’s manager on the org chart does not put a person in this group, so add people to it deliberately.
The two HR groups do different things. “Human Resources” is the group whose members get the HR step of an onboarding or offboarding run in their list. “HR Managers” carries the fuller “hr_manager” role (approving runs, managing recruitment, editing employee files) but does not by itself put that HR step in a person’s list. Someone who does both belongs in both groups.
The roles attached to those groups deliberately leave out the most sensitive powers, such as Security Settings, changing roles and permissions, and approving payments. Nobody gets those just by being put in a group.
Two built-in roles do carry them, and are not attached to any group, so you assign them by hand: “security_analyst” can change Security Settings, and “finance_approver” can approve and pay invoices, approve budgets and close the period. Give them out deliberately. “administrator” holds everything.
Create a custom role
Step 1: Open Roles
Go to AdministrationRoles (the page is titled “Role Management”) and click “CREATE ROLE”.
Step 2: Name it and pick its permissions
Enter a “Role Name” and a “Description”. Under “PERMISSIONS GRANTED”, tick what the role allows. Each permission shows a short description, and “Filter permissions…” helps you find one.
A permission marked “LOCKED” is one you do not hold yourself, so you cannot hand it out.
Step 3: Choose who holds it
Under “ROLE MEMBERS”, use “Assign to Groups (members inherit this role automatically)” to attach it to a group, or “Individual Members (assigned one by one)” for specific people. Attaching to a group is easier to keep tidy.
Step 4: Save
Click “Save Role”. To change it later, use the edit button on its row and click “Update Role”.
Put people in a group
Step 5: Open Groups
Go to AdministrationGroups (titled “Group Management”). To use an existing group, click “Edit Group” on its row. To make a new one, click “CREATE GROUP” and give it a “Group Name”.
Step 6: Add members
In the “Members” step, search for and add each person. Click “Create Group” or “Update Group”.
A new group grants nothing until a role is attached to it. Do that from the role, as in step 3 above.
Require MFA for a group
Step 7: Set the group's MFA policy
In the group’s “MFA Policy” step, under “LOGIN MFA POLICY”, choose one:
“Inherit default” follows your organisation-wide MFA setting. “Require” makes every member set up and use MFA. “Exempt” lets members skip MFA; give it an “Exempt until (blank = permanent)” date and a “Reason (audit trail)”.
An exemption does not cover everyone. Administrators, and anyone holding the permission to manage security, to manage users or to mark approved invoices as paid, always need a second factor at sign-in. No group exemption lifts that, and neither does ticking Trust this device for 30 days.
Make a one-off exception
Step 8: Open Access Control
Go to AdministrationAccess Control (titled “Access Control”). It opens on “By permission”. Search for the permission with “Search policies...” and select it.
Step 9: Grant it to one person
In “Individual User Exceptions”, add the person, then click “COMMIT ACCESS CHANGES”. Sensitive permissions ask you to confirm first.
Careful: “Authorized Roles” on the same screen changes the role itself, so it affects everyone who holds that role.
Step 10: Check what someone can actually do
Switch to “By user” and pick a person. You see their roles and every permission they hold, each labelled with where it comes from. A one-off grant shows as “DIRECT OVERRIDE”.
What you should see
On the Roles page, your role shows the people and groups that hold it. On the Groups page, an MFA-required group shows a green shield; hovering it reads “MFA ENFORCED”.
In “By user”, the person’s permissions match what you intended.
If something goes wrong
- "You cannot grant permissions you do not hold"
- You can only hand out access you have yourself. Ask an administrator to create or change the role.
- "You cannot change membership of a group that grants access you don't hold"
- The group carries a role more powerful than yours. An administrator has to add or remove its members.
- The MFA choices are greyed out: "Only a security administrator can change the MFA policy."
- Ask someone who can manage Security Settings to set the group's MFA policy.
- You put someone in a group but they still cannot see a page
- A group only grants what its roles grant. Attach a role to the group from the Roles page, then check the person in Access Control under By user.
- A yellow "Redundant override" warning in Access Control
- That person already gets the permission through one of their roles. Remove the one-off grant to keep access managed through roles.
Still stuck? See When something goes wrong, or Contact Zonitix support.