ACC Docs - Permission Settings: Linking Companies and Roles for Scalable Permission Control

[jmeuris]

Following the ISO 19650 folder structure for large civil and infrastructure projects, correctly assigning folder permissions is essential. Currently, this process is challenging because there is no way to link the assigned user’s company with their role.

Creating ISO 19650-based roles is not desirable, as it would result in an excessive number of roles, reducing clarity. In the worst case, permissions would need to be assigned individually to users. To address this, it would be highly beneficial to enable a relationship between companies and roles when assigning folder permissions (and/or rules).

This would:

• Simplify the setup of large-scale projects and streamline permission management during execution.
• Eliminate the need for user-based permissions, improving overall data access security.
• Reduce role clutter at both the project and hub levels, maintaining readability and manageability.
• New users automatically inherit correct permissions based on their company-role relationship, minimizing manual setup. Resulting in faster onboarding
• Easier to track and verify access rights for compliance with ISO 19650 and internal governance.
• Supports growth and complexity in large projects without exponentially increasing role management complexity.

[jboardmanVP55U]

Either this or multiple default roles. 
But companies being a manual project only thing is getting old really fast. 

[guillaume_neyrinckF8446]

Hi @jmeuris ,

Thanks for the idea!
Do I understand correctly that you would like the roles & companies to be automatically combined? The "Company X Role" combination would be used when assigning permissions. 
E.g. A simpel example: only the BIM managers from company A have access to a specific folder. Currently this can only be achieved by using individuals or making hundreds of custom roles polluting the account admin.

[jboardmanVP55U]

@guillaume_neyrinckF8446 
Currently the project templates don't allow for a company to be set for permissions, which means I have to go into each project to manually set company permissions. So the backend relationship is already there, but there is not way to make these things default in project creation. 

[jmeuris]

@guillaume_neyrinckF8446 

Yes, that’s essentially the idea.
We experimented with this approach a few years ago using the ISO 19650 structure and ended up with a list of more than 300 roles—which was far too excessive. Needless to say, we didn’t include those in our project template.

By combining companies and roles, you can significantly reduce the overall role count and ultimately build a more efficient and scalable system, especially in a WIP environment. As in your example, this principle can be applied directly to the folder structure or used as a cascading approach—assigning permissions at the top-level folder to the company and then applying related roles to the subfolders.

Additionally, we believe that an improved permission system could also enhance the review process.

[GaryOrrMBI]

I think that more emphasis on the Company based permissions assignments need to be expanded into all modules and, more importantly, into project templates. We have a folder structure that we want to define permissions to everyone at our company to, yet our only options are by role or "Everyone" at the template level.

We may have roles assigned to members of a project that apply to outside consultants as well as internal employees. We need these two treated differently at many different levels and across different modules, and we definitely don't want everyone to have the expanded rights that our internal employees need. Right now, Project setup is overly cumbersome due to the lack of being able to assign permissions based on Companies.

-G