Roles and permissions
WorkOrder access is evaluated for each action. SolarSENS uses plant scope, contractor read permission, plant-specific capabilities, and selected role checks rather than one role ladder for every control.
Overview
Section titled “Overview”To open a work order, a user must be able to read its plant. Contractor access can narrow that read boundary further. Creating work depends on the selected plant’s create permission, while other actions have their own access requirements.
The platform authorizes each action. Interface visibility does not define whether an action is authorized.
Why it matters
Section titled “Why it matters”- Plant scope keeps work-order records within the appropriate plant boundary.
- Create permission can differ between plants.
- Elevated checks protect management analytics and destructive actions.
- An action-specific model helps teams assess access based on the work they need to do.
Evaluate access for an action
Section titled “Evaluate access for an action”Use these four questions when determining whether a user can complete a work-order action:
- Can the user read the work order’s plant?
- Can the user create or edit work for that plant?
- Is the action available in the work order’s current lifecycle state?
- Does the action require an admin or supervisor role?
The answer can differ by action and by plant.
Action boundaries
Section titled “Action boundaries”| Action or area | What SolarSENS evaluates | Important boundary |
|---|---|---|
| Open work-order detail | The user must be able to read the work order’s plant. | Contractor access can narrow the plant read boundary further. |
| Create work | The selected plant must allow the user to create work. | SolarSENS records the requester from the authenticated user; the requester is not selected freely. |
| Assign, resolve, archive, or unarchive | Access depends on the user’s plant access and assigned capabilities. | The work order’s lifecycle state can make an action unavailable. |
| General edits and some unarchive paths | Access can depend on the plant’s create capability. | If an action is not available, confirm the user’s plant access and assigned capabilities with an administrator. |
| WorkOrder analytics | Admin or supervisor access is required. | This management view is limited to users with the elevated role. |
| Direct deletion and delete-request review | Admin or supervisor access is required. | Users without management-level delete access can submit a delete request instead of deleting directly. |
| Attachment deletion | Admin or supervisor access is required. | The work order must remain in an eligible active state. |