Multiple admin roles & permissions

Question

Does anybody have experience with how multiple admin roles within an account interact? If one role grants a permission and the other denies it, I assume the end result would be that the permission is denied to the user?

I don't recall if we actively have "use default" applied, does that enter into how they're applied?

I'm considering whether it'd work and be worth having some roles that add a minor permission (post announcements) that could be given in addition to existing roles.

Chris · Accepted Answer

Hi @rtoon,

It's actually the opposite of your statement in my experience with this.  As long as the user has one role that grants the permission (in whatever context they are in, course, admin page, etc), even if the users other roles do not grant permission, they'll have the ability to take whatever the action is in Canvas.

"Use Default" shouldn't come into play here, as that just makes the permission on/off in the end.

-Chris

Mikee · Accepted Answer

The role definitions are permissive, not restrictive;

if the user holds an admin type that permits an action, and another role held does not - the action is permitted.

Non-permitted actions are not 'prohibit' so do not remove permissions granted elsewhere.