Logic for Hierarchical Permissions to Take Effect

The permission carrier Dept. in the decision-making system can be organized in a tree structure, with parent and child departments. Such structure will be referred to as the permission carrier tree hereinafter.

The permission entity Directory in the decision-making system can be organized in a tree structure, with parent and child directories. Such structure will be referred to as the permission entity tree hereinafter.

If you assign parent/child directory permissions to parent/child departments in different time sequences, the result will be different.

Note:

The permission configuration in this document refers to enabling or disabling permissions on certain dimensions (such as the View dimension and the Edit dimension).

1. For tree structures, if you configure permissions of child nodes before you configure permissions to their parent node, the permissions of the parent node will override the permissions of the child nodes in the dimensions corresponding to the permission dimensions of the parent node configured. 

2. For tree structures, if you configure permissions of a parent node before you configure different permissions of its child nodes, the permissions of the parent and child nodes take effect independently and do not affect each other. 

Note:

1. The above principles also apply to positions and child departments, whose permissions will also be overridden by the permissions configured to their parent departments.

2. Permission Quick Configuration is also subject to the above principles.

Logic

For tree structures, if you configure permissions of child nodes before you configure permissions of their parent node, the permissions of the parent node will override the permissions of the child nodes in the dimensions corresponding to the permission dimensions of the parent node configured. 

Permission Carrier Tree

Logic

For the same permission entity (such as the same directory), if you configure permissions to a child department before you configure permissions to its parent department, the permissions of the parent department will override the permissions of the child department in the dimensions corresponding to the permission dimensions configured to the parent department. /

Scenario

You have first assigned the permission on the View dimension of the directory to the child department, and assigned permissions on the View and Edit dimensions of the directory to the parent department.

Result

The permissions of the parent department will override the permissions of the child department in the dimensions corresponding to the permission dimensions configured to the parent department.

The permission dimensions configured to the parent department are View and Edit, so the child department also has permissions on the View and Edit dimensions.

Permission Entity Tree

Logic

Assume that a permission entity is organized in a tree structure (such as a directory tree). When you configure permissions on the child node before you configure permissions on the parent node to the same permission carrier (such as a role), the permissions of the parent node will override the permissions of the child node in the dimensions corresponding to the configured permission dimensions of the parent node. /

Scenario

You have first assigned the permissions on the View and Edit dimensions of the child directory 1 to the role X, and assigned the permission on the View dimension of the parent directory to the role X.

Result

The permissions of the parent directory will override the permissions of the child directory in the dimensions corresponding to the configured permission dimensions of the parent directory, such as the View dimension of the parent directory.

The permissions of the parent directory cannot override the permissions of the child directories in the dimensions corresponding to the unconfigured permission dimensions of the parent directory, such as the Edit dimension of the parent directory.

The permission on the View dimension of the child directory is overridden, but the permission on the Edit dimension of the child directory is not overridden. Therefore, the child directory 1 is finally configured with the viewing and editing permissions.

Parallel Permission Tree

Logic

For permission carrier trees (parent-child departments) and permission entity trees (parent-child directories), if you first configure permissions on the child directory to the child department, and configure permissions on the parent directory to the parent department, the parent department's permissions on the parent directory will override the child department's permissions on the child directory in the dimensions corresponding to the permission dimensions of the parent directory configured to the parent department. /

Scenario

You have first assigned the permissions on the View and Edit dimensions of the child directory 1 to the child department, and assigned the permission on the View dimension of the parent directory to the parent department.

Result

The parent department's permission on the parent directory will override the child department's permissions on the child directory in the dimensions corresponding to the permission dimensions of the parent directory configured to the parent department, such as the View dimension of the parent directory.

The parent department's permission on the parent directory cannot override the permission on the child directory in the dimensions corresponding to the permission dimensions of the parent directory not configured to the parent department, such as the Edit dimension of the parent directory.

The permission on the View dimension of the child directory is overridden, but the permission on the Edit dimension of the child directory is not overridden. Therefore, the child directory 1 is finally configured with the viewing and editing permissions.

Cross-Permission Tree

Logic

For permission carrier trees (parent-child departments) and permission entity trees (parent-child directories), if you first configure permissions on the parent and child directories to a child department, and configure permissions on the parent directory to the parent department, the parent department's permissions on the parent directory will override the child department's permissions on the parent and child directories in the dimensions corresponding to the permission dimensions of the parent directory configured to the parent department. /

Scenario

You have first assigned the permission on the View dimension of the parent directory to the child department, then assigned the permissions on the View and Edit dimensions of the child directory 1 to the child department, and finally assigned the permissions on the View and Edit dimensions of the parent directory to the parent department.

Result

The parent department's permissions on the parent directory will override the child department's permissions on the parent and child directories in the dimensions corresponding to the permission dimensions of the parent directory configured to the parent department, such as the View and Edit dimensions of the parent directory.

The child department's permissions on the View and Edit dimensions of the parent and child directories are overridden, so the child department is finally configured with the viewing and editing permissions of the parent directory and all the child directories.

Logic

For tree structures, if you first configure permissions of the parent node, and configure different permissions of the child node, the permissions of the parent and child nodes take effect independently without affecting each other.

Permission Carrier Tree

Logic

For the same permission entity (such as the same data connection), if you first configure permissions to the parent department, and configure permissions to the child department, the permissions of the parent and child departments do not affect each other and take effect independently.

Scenario

You have assigned the permissions on the View and Edit dimensions of the child directory 1 to the parent department, and assigned the permission on the View dimension of the child directory 1 to the child department.

Result

The parent department's permissions on the View and Edit dimensions of the child directory 1 remain unchanged, and permission on the Edit dimension of the child directory 1 remains unchanged.

Permission Entity Tree

Logic

If a permission entity is organized in a tree structure (such as a directory tree), for any permission carrier, when you configure permissions of the parent node before you configure permissions of the child node, the permissions of the parent and child nodes are both retained and do not affect each other.

Scenario

You have assigned the permission on the View dimension of the parent directory to the role X, and assigned the permissions on the View and Edit dimensions of the child directory 1 to the role X.

Result

The role X's permission on the View dimension of the parent directory remains unchanged, and the role X's permissions on the View and Edit dimensions of the child directory 1 remain unchanged.

Parallel Permission Tree

Logic

For permission carrier trees (parent-child departments) and permission entity trees (parent-child directories), if you first configure permissions on the parent directory to the parent department, and configure permissions on the child directory to the child department, the parent department's permissions on the parent directory will override the child department's permissions on the parent and child directories in the dimensions corresponding to the permission dimensions of the parent directory configured to the parent department. However, the permissions on the child directories subsequently configured will retain the settings of the child department.

Scenario

You have assigned the permission on the View dimension of the parent directory to the parent department, disabled the permission on the View dimension of the child directory 1 to the child department, and enabled the permission on the Edit dimension of the child directory 2 to the child department.

Result

The parent department's permission on the View dimension of the parent directory remains unchanged.

The parent department's permission on the parent directory will override the permission on the child directory in the dimension corresponding to the permission dimension of the parent directory configured to the parent department, such as the View dimension. So, the parent department has the viewing permission on the child directories.

The child department's permissions on the child directory 1 and the child directory 2 remain unchanged. The child department has no permission on the child directory 1, but has viewing and editing permissions on the child directory 2.

The parent department's permissions on the parent directory will override the child department's permissions on the parent and child directories in the dimensions corresponding to the permission dimensions of the parent directory configured to the parent department. The child department has the viewing permission on the parent and other child directories.

Cross-Permission Tree

Logic

For permission carrier trees (parent-child departments) and permission entity trees (parent-child directories), if you first configure permissions on the parent directory to the child department, and configure permissions on the child directory to the parent department, the permission settings take effect in the time order. That is to say, the child department's permissions on the child directory are first overridden by the permissions on the parent directory configured to the child department, and then overridden by the permissions on the child directory configured to the parent department.

Scenario

You have first assigned the permission on the View dimension of the parent directory to the child department, and assigned the permissions on the View and Edit dimensions of the child directory 1 to the parent department.

Result

The child department's permissions on the child directory are first overridden by the permissions on the parent directory configured to the child department. That is to say, the child department has the viewing permission on the child directory.

Then the permissions are overridden by the permissions on the child directory configured to the parent department. So, the child department has the viewing and editing permissions on the child directory 1.