tiCrypt
Permissions
Permissions decide what a user can do in tiCrypt. You give them in a user profile, or to a single user in Management > Users. In the permission list, permissions are grouped in categories; tick a category to give all of its permissions.
A permission works together with the user's role. Permissions that act on other users, such as Deactivate users with a lower role, only work on users whose role is lower than the user's own. Super-admins have every permission.
Each table below lists:
- Permission: the name shown in the permission list.
- What it allows: what a user with the permission can do, and what else they need.
- Type: whether the permission lets the user view, create, edit or delete something.
- ID: the permission ID used in exported and imported user profiles.
Permissions That Work Together
Some tasks need more than one permission. A user who has only some of them sees the action but it fails, or does not see it at all.
| To let a user… | Give them all of these |
|---|---|
| Upload files to the Vault | Create files (needed to upload), Share their files (also needed to upload) and Upload file content (needed to upload) |
| Download files | View their files and files shared with them (needed to download), Get the keys of their files and files shared with them (needed to download) and Download the content of files they can access; for files shared with a group, also Get the keys of groups they are a member of (needed to open and share group files) |
| Create directories | Create directories (also needs “Add items to directories”) and Add items to directories |
| Share files with a group | Share their files (also needed to upload) and Get the keys of groups they are a member of (needed to open and share group files) |
| Share a drive or attach it to a VM | Get drive keys (needed to share and attach drives), plus Share drives or Attach drives to VMs |
| Give other users access to a VM | Share VMs with other users and View other users' VM usernames (needed to share VMs) |
System Settings
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View system settings, such as the login logo | Lets the user read the system-wide settings that override the deployment file, such as the login logo and login message. tiCrypt Connect uses these settings, so most users need this permission. | View | ReadGlobalInfo |
System Settings Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Change system settings | Lets the user change system-wide settings in Management > System Settings, such as the login logo, login message and session timeouts, without sending a new deployment file to every user. | Edit | WriteGlobalInfo |
| Reset system settings to the deployment file's values | Lets the user remove a system setting. tiCrypt then uses the value from the deployment file again. | Delete | DeleteGlobalInfo |
| Export the system database | Lets the user start an export of the system's MongoDB database. | View | InitiateMongoExport |
User Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all users, not only those in their teams, groups and projects | Lets the user see every user in the system. Without it, a user sees only the people in their own teams, and the users they meet through shared groups and projects. | View | ListAllUsers |
| Edit the details of users with a lower role (name, email, department, position) | Lets the user change the name, contact email, department, position and deactivation reason of users with a lower role. Users can always edit their own details without this permission. | Edit | ModUser |
| Change the permissions of users with a lower role | Lets the user change the permissions of users with a lower role. Super-admins can also change other super-admins' permissions, but super-admins have every permission anyway. | Edit | ChangePerm |
| Raise the role of users with a lower role, up to their own role | Lets the user raise the role of a user with a lower role, up to (and including) their own role. For example, an admin can make a user a sub-admin or an admin. | Edit | Promote |
| Lower the role of users with a lower role | Lets the user lower the role of a user who already has a lower role than theirs. | Edit | Demote |
| View user profiles (permission templates) | Lets the user see the user profiles in Management > User Profiles. A user profile is a saved role and set of permissions that can be applied to users. | View | ReadGlobalSettings |
| Create and edit user profiles | Lets the user create, edit, clone and import user profiles. | Edit | WriteGlobalSettings |
| Delete user profiles | Lets the user delete user profiles. Deleting a profile does not delete the users it was applied to. | Delete | DeleteGlobalSettings |
| Activate users with a lower role | Lets the user activate users with a lower role. Activating a user who was set to escrow their key at next sign-in cancels that escrow, because a user can be in only one state. | Edit | Activate |
| Deactivate users with a lower role | Lets the user deactivate users with a lower role. A deactivated user cannot sign in. | Edit | Deactivate |
| Make users with a lower role escrow their key at their next sign-in | Lets the user mark users with a lower role so that their private key is escrowed automatically the next time they sign in. After that, the user is active again. | Edit | RequireEscrow |
| Delete users with a lower role | Lets the user delete users with a lower role. Super-admins can also delete other super-admins. Deleted users are kept on record and can be restored. | Delete | DelUser |
| View deleted users | Lets the user see the users that were deleted but are still on record, in Management > Deleted Users. | View | GetDeletedUsers |
| Restore deleted users | Lets the user restore a deleted user, so they can sign in again. | Edit | ReenableUsers |
| Add users (future feature, no effect yet) | It has no effect today; it is reserved for a future feature. | Create | AddUser |
| View what every sub-admin manages | Lets the user list the teams, projects and other objects that every sub-admin manages, as shown in Sub-admin Managed Objects. Super-admins can always do this. | View | ListAllSubadminManagedObjects |
Teams
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View teams they are a member of | Lets the user see the teams they belong to. | View | GetTeamInfo |
| Edit teams they are a member of, as far as their team role allows | Lets the user change the name, description and members of teams they belong to, as far as their role in each team allows. | Edit | ModTeam |
Team Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all teams | Lets the user see every team in the system, not only their own. | View | GetAnyTeamInfo |
| Create teams | Lets the user create teams. | Create | CreateTeam |
| Edit any team | Lets the user change any team, including teams they are not a member or manager of. | Edit | ModAnyTeam |
| Delete any team | Lets the user delete any team. | Delete | DeleteTeam |
| Add users to any team | Lets the user add users to any team. | Create | AddAnyTeamMember |
| Edit the members of any team | Lets the user change the members of any team, such as their role in the team. | Edit | ModAnyTeamMember |
| Remove users from any team | Lets the user remove users from any team. | Delete | RemAnyTeamMember |
Key Escrow
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Put their own private key in escrow | Lets the user put their own private key in escrow: tiCrypt stores it split into encrypted parts held by different escrow users, so the key can be recovered if the user loses it. | Create | EscrowKey |
| Check whether their own key is in escrow | Lets the user check whether their own private key is in escrow. | View | QueryOwnKeyEscrowed |
Key Escrow Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all keys in escrow | Lets the user see every key that is in escrow in the system. | View | ListEscrowedKeys |
| View escrow recovery keys | Lets the user see information about the recovery keys of escrowed keys. | View | ListEscrowRecoveryKeys |
| Delete keys from escrow, with their recovery parts | Lets the user delete a key from escrow, together with its recovery parts. The key can no longer be recovered through escrow. | Delete | DeleteEscrowedKeyAndRecoveryParts |
| View escrow groups | Lets the user see the escrow groups in the system. | View | GetEscrowGroups |
| View escrow users | Lets the user see information about escrow users. | View | GetEscrowUser |
| View escrow public keys | Lets the user get the public key of an escrow user or group, which is needed to escrow a key to them. | View | GetEscrowPublicKey |
| View the history of escrow actions approved with a Sitekey | Lets the user see the history of escrow actions that were approved with a Sitekey. | View | ListEscrowCertificates |
Vault Files and Directories
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View their files and files shared with them (needed to download) | Lets the user see the files they own, the files shared with them and the files they shared. Needed to download a file. | View | GetFileInfo |
| View the history of their files (sharing, project tags, deletion) | Lets the user see the history of their files: when each file was created, shared or unshared, tagged with a project, or deleted. | View | GetFileHist |
| Create files (needed to upload) | Lets the user create new files in the Vault. Uploading a file also needs Share their files (to store the user's own key for the file) and Upload file content. | Create | CreateFile |
| Get the keys of their files and files shared with them (needed to download) | Lets the user get the key that decrypts a file they own or that was shared with them. Needed to download a file. For a file shared with a group, the user also needs Get the keys of groups they are a member of. | View | GetFileKey |
| Share their files (also needed to upload) | Lets the user share their files with users and groups. Also needed to upload, because uploading stores the user's own key for the new file. Sharing with a group also needs Get the keys of groups they are a member of. | Create | AddFileKey |
| Unshare their files | Lets the user unshare their files from users and groups. | Delete | DelFileKey |
| Download the content of files they can access | Lets the user download the encrypted content of files they can access. Downloading also needs View their files… and Get the keys of their files…. | View | ReadChunk |
| Upload file content (needed to upload) | Lets the user upload the encrypted content of files. Needed to upload. | Edit | WriteChunk |
| Transfer files from the Vault to VMs | Lets the user copy files from their Vault into a VM. | View | ReadChunkInternal |
| Transfer files from VMs to the Vault | Lets the user copy files from a VM into their Vault. | Edit | WriteChunkInternal |
| Delete their files | Lets the user delete files they own. | Delete | DeleteFile |
| View their directories and their groups' directories | Lets the user see the contents of their own directories and of the directories of groups they belong to. | View | GetDirInfo |
| Create directories (also needs “Add items to directories”) | Lets the user create directories. A new directory also has to be placed in an existing one, so this needs Add items to directories too. In a group's directories, the user's group permissions must also allow it. | Create | CreateDir |
| Delete directories (also needs “Remove items from directories”) | Lets the user delete directories they own, or group directories where they may remove items. Removing the directory from its parent also needs Remove items from directories. | Delete | DelDir |
| Add items to directories | Lets the user add files and directories to their directories. In a group's directories, the user's group permissions must also allow it. | Create | CreateDirEntry |
| Rename files and directories | Lets the user rename files and directories. In a group's directories, the user's group permissions must also allow it. | Edit | ModDirEntry |
| Remove items from directories | Lets the user remove files and directories from their directories. In a group's directories, the user's group permissions must also allow it. | Delete | DelDirEntry |
| View any user's Vault storage use | Lets the user see how much Vault storage any user uses, including themselves. | View | GetAnyVaultUsage |
| View the usage statistics of their own files | Lets the user see usage statistics for the files they own. | View | GetFileUsage |
| View the usage statistics of every user's files | Lets the user see usage statistics for the files of every user. | View | GetAllFileUsage |
| View the usage statistics of their own directories | Lets the user see usage statistics for the directories they own. | View | GetDirectoryUsage |
| View the usage statistics of every user's directories | Lets the user see usage statistics for the directories of every user. | View | GetAllDirectoryUsage |
| View the usage statistics of a project's files (future feature, no effect yet) | It has no effect today; it is reserved for a future feature. | View | GetProjectFileUsage |
| View the usage statistics of every project's files (future feature, no effect yet) | It has no effect today; it is reserved for a future feature. | View | GetAllProjectFileUsage |
| View the usage statistics of a project's directories (future feature, no effect yet) | It has no effect today; it is reserved for a future feature. | View | GetProjectDirectoryUsage |
| View the usage statistics of every project's directories (future feature, no effect yet) | It has no effect today; it is reserved for a future feature. | View | GetAllProjectDirectoryUsage |
Groups
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View groups they are a member of | Lets the user see the groups they belong to. | View | GetGroupInfo |
| Get the keys of groups they are a member of (needed to open and share group files) | Lets the user get their copy of the key of each group they belong to. Without it, the user cannot open files shared with their groups, share files with groups, or add people to their groups. | View | GetGroupKey |
| Create groups | Lets the user create groups, which are used to share files with several people at once. | Create | CreateGroup |
| Rename groups they own and give ownership to another member | Lets the user rename groups they own, and give ownership of a group to another member. | Edit | ModGroup |
| Add users to groups they are a member of, if the group allows it | Lets the user add people to groups they belong to. Unless they own the group, their permissions inside the group must also allow adding members. | Create | AddGroupMem |
| Change other members' group permissions in groups they are a member of | Lets the user change what other members may do inside groups they belong to. Group owners can always do this in their own groups. | Edit | ModGroupPerm |
| Remove users from groups they are a member of, if the group allows it | Lets the user remove people from groups they belong to. Unless they own the group, their permissions inside the group must also allow it. Nobody can remove a group's owner; the owner must give ownership to someone else first. | Delete | RemGroupMem |
| Delete groups they own | Lets the user delete groups they own. | Delete | DeleteGroup |
Inboxes
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View their inboxes | Lets the user see which of their directories are inboxes. | View | ListMailboxes |
| Create inboxes, so people without an account can send them files | Lets the user turn one of their directories into an inbox, so people without a tiCrypt account can send files securely to their Vault. | Create | CreateMailbox |
| Delete their inboxes | Lets the user remove inboxes they created. | Delete | DeleteMailbox |
Projects
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View projects they are a member of | Lets the user see the projects they belong to. | View | ListOwnProjects |
| View the members of projects they are a member of | Lets the user see the other members of projects they belong to. | View | ListOwnProjectMemberships |
| View all security requirements | Lets the user see all security requirements: what a user must be certified for before they can use a project's restricted items. | View | ListSecurityRequirements |
| View all security levels | Lets the user see all security levels that can be set on projects. | View | ListSecurityLevels |
| View their own certifications | Lets the user see their own certifications, which show the security requirements they meet. | View | ListOwnUserCertifications |
| Tag what they own with a project they are active in | Lets the user tag what they own (such as files and drives) with a project they are active in. A project tag restricts the item to members of the project who are certified for its security requirements. | Edit | HeightenProjectTag |
Project Management
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Remove project tags of projects they manage | Lets a project manager remove the project tag of a project they manage from items, which makes them less restricted. | Edit | LessenProjectTag |
| Create subprojects in projects they manage | Lets a project manager create subprojects inside projects they manage. | Create | ManagerCreateProject |
| Edit projects they manage | Lets a project manager change the name and details of projects they manage. | Edit | ManagerModifyProject |
| Delete projects they manage | Lets a project manager delete projects they manage. | Delete | ManagerDeleteProject |
| Add users to projects they manage | Lets a project manager add users to projects they manage. | Create | ManagerAddProjectMembership |
| Edit memberships, such as expiration dates, in projects they manage | Lets a project manager change memberships in projects they manage, such as when a membership expires. | Edit | ManagerModifyProjectMembership |
| Remove users from projects they manage | Lets a project manager remove users from projects they manage. | Delete | ManagerRemoveProjectMembership |
| View all users' certifications | Lets the user see every user's certifications for security requirements. | View | ListUserCertifications |
| Certify users for security requirements | Lets the user record that a user meets a security requirement (certify them). | Create | AddUserCertification |
| Edit users' certifications, such as expiration dates | Lets the user change a user's certification, such as when it expires. | Edit | ModifyUserCertification |
| Remove users' certifications | Lets the user remove a certification from a user. | Delete | DeleteUserCertification |
Project Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View all projects | Lets the user see every project in the system. | View | ListAnyProject |
| Tag anything with any project | Lets the user tag any item with any project, or change or remove its tag, whether or not they own it or belong to the project. | Edit | SetProjectTag |
| Create security requirements | Lets the user create security requirements. | Create | CreateSecurityRequirement |
| Edit security requirements | Lets the user change security requirements. | Edit | ModifySecurityRequirement |
| Delete security requirements | Lets the user delete security requirements. | Delete | DeleteSecurityRequirement |
| Create security levels | Lets the user create security levels. | Create | CreateSecurityLevel |
| Edit security levels | Lets the user change security levels. | Edit | ModifySecurityLevel |
| Delete security levels | Lets the user delete security levels. | Delete | DeleteSecurityLevel |
| Create top-level projects | Lets the user create top-level projects (projects that are not inside another project). | Create | CreateProject |
| Edit any project | Lets the user change any project, whether or not they manage it. | Edit | ModifyProject |
| Delete any project | Lets the user delete any project. | Delete | DeleteProject |
| View the members of every project | Lets the user see the members of every project, and every project a user belongs to. | View | ListAnyProjectMembership |
| Add users to any project | Lets the user add users to any project. | Create | AddProjectMembership |
| Edit memberships in any project | Lets the user change any project membership, such as when it expires. | Edit | ModifyProjectMembership |
| Remove users from any project | Lets the user remove users from any project. | Delete | RemoveProjectMembership |
Virtual Machines
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View their drives | Lets the user see their encrypted drives. | View | GetDriveInfo |
| Create drives | Lets the user create encrypted drives for VMs. | Create | CreateDrive |
| Edit drives (name and backup setting) | Lets the user change a drive's name and whether it is backed up. | Edit | ModifyDrive |
| Get drive keys (needed to share and attach drives) | Lets the user get the key of a drive. Needed to share a drive and to attach it to a VM. | View | GetDriveKey |
| Share drives | Lets the user share drives with other users. | Create | AddDriveKey |
| Unshare drives | Lets the user unshare drives. | Delete | DelDriveKey |
| Attach drives to VMs | Lets the user attach drives to VMs. | Edit | AttachDrive |
| Detach drives from VMs | Lets the user detach drives from VMs. | Edit | DetachDrive |
| Delete drives they own | Lets the user delete drives they own. | Delete | DeleteDrive |
| View the VM hardware setups available to them | Lets the user see the VM hardware setups (hardware and image combinations) they may use to start VMs. | View | GetBrickInfo |
| View their VM configurations and those shared with them | Lets the user see their own VM configurations and the ones shared with them. | View | GetVMConfigInfo |
| Create and edit VM configurations | Lets the user create and edit VM configurations. | Create | CreateVMConfig |
| Start VMs from VM configurations | Lets the user start VMs from VM configurations. | Create | RunVMConfig |
| Force-stop VMs started from VM configurations | Lets the user force-stop VMs that were started from VM configurations. | Delete | KillVMConfig |
| Open VM configurations (future feature, no effect yet) | It has no effect today: a user can open any VM configuration that is listed for them without it. | View | ReadVMConfig |
| View their own VM username | Lets the user see their own VM username, the login name they have on every VM. | View | GetOwnVirtAccountInfo |
| View other users' VM usernames (needed to share VMs) | Lets the user see other users' VM usernames. Needed to give other users access to a VM. | View | GetAnyVirtAccountInfo |
| Let their VMs transfer files straight to their Vault | Lets the user's VMs act for them with a limited session, such as to copy files straight from the VM to the user's Vault. | Create | CreateSubSession |
| View their VMs and VMs shared with them | Lets the user see their own VMs and the VMs shared with them. | View | GetVMInfo |
| Start VMs without a VM configuration | Lets the user start VMs without using a VM configuration. | Create | CreateVM |
| Connect to their VMs and VMs shared with them | Lets the user connect to their own VMs and the VMs shared with them, for example to open a terminal or desktop. | View | ProxyToVM |
| Share VMs with other users | Lets the user give other users access to their VMs. | Create | AuthorizeVMAccess |
| Shut down their VMs | Lets the user shut down their VMs. | Delete | DeleteVM |
| View the storage pools of any realm | Lets the user see the Libvirt storage pools of any realm. | View | GetPoolsForRealm |
| Look up individual storage pools | Lets the user look up a single Libvirt storage pool by its type or ID. | View | GetStoragePool |
VM Administration
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Delete any drive | Lets the user delete any drive in the system, whether or not they own it or it is shared with them. | Delete | DeleteAnyDrive |
| Create storage pools | Lets the user create Libvirt storage pools, which hold raw volumes such as drive and VM image files. | Create | CreateStoragePool |
| Edit any storage pool | Lets the user change any storage pool. | Edit | UpdateStoragePool |
| Delete any storage pool | Lets the user delete any storage pool. | Delete | DeleteStoragePool |
| View raw volumes (VM image files) | Lets the user see the raw volumes (VM image files) in the storage pools. | View | ListRawImages |
| Upload raw volumes (VM image files) | Lets the user upload raw volumes, such as VM image files. | Create | UploadLargeObject |
| View all VM images | Lets the user see all VM images. | View | ListImages |
| Create VM images from raw volumes | Lets the user create VM images from raw volumes. | Create | CreateImages |
| Edit any VM image | Lets the user change any VM image. | Edit | ModifyImages |
| Delete any VM image | Lets the user delete any VM image. | Delete | DeleteImages |
| View all VM hardware setups | Lets the user see every VM hardware setup in the system. | View | ListAnyBricks |
| Create VM hardware setups | Lets the user create VM hardware setups. | Create | CreateBrick |
| Edit any VM hardware setup | Lets the user change any VM hardware setup. | Edit | ModifyAnyBrick |
| Delete any VM hardware setup | Lets the user delete any VM hardware setup. | Delete | DeleteAnyBrick |
| View all VM configurations | Lets the user see every VM configuration in the system. | View | ListAnyVMConfig |
| Edit any VM configuration | Lets the user change any VM configuration. | Edit | ModifyAnyVMConfig |
| Delete any VM configuration | Lets the user delete any VM configuration. | Delete | DeleteAnyVMConfig |
| Delete any VM configuration, second permission (future feature, no effect yet) | It has no effect today; the server checks Delete any VM configuration instead. | Delete | DeleteAnyMVConfig |
| View the history of any VM configuration | Lets the user see the change history of any VM configuration. | View | GetVMCHist |
| View VM host machines and their hardware in any realm | Lets the user see the VM host machines of every realm and their hardware. | View | ViewHosts |
| Create hardware profiles | Lets the user create hardware profiles, which describe the hardware of host machines. | Create | CreateHardwareProfile |
| Edit any hardware profile | Lets the user change any hardware profile. | Edit | ModifyHardwareProfile |
| Delete any hardware profile | Lets the user delete any hardware profile. | Delete | DeleteHardwareProfile |
| Add VM host machines to realms | Lets the user add VM host machines to realms. | Create | AddHosts |
| Edit VM host machines in any realm | Lets the user change the details of VM host machines in any realm. | Edit | ModifyHosts |
| Remove VM host machines from any realm | Lets the user remove VM host machines from any realm. | Delete | DeleteHosts |
| Reserve hosts from an external resource pool | Lets the user request VM host machines from an external resource pool. | Create | AddReservation |
| View external host reservations | Lets the user see every request to reserve hosts from an external resource pool. | View | ListReservations |
| Return reserved hosts to the external resource pool | Lets the user give reserved hosts back to the external resource pool. | Delete | ReturnReservations |
| View licensing servers | Despite its name, it does not give access to licensing servers. It lets an admin open Management > Miscellaneous > External SFTP Servers and see every external SFTP server. Sub-admins cannot open that table, even with this permission. Creating, editing and deleting external SFTP servers stays super-admin only. | View | GetExternalServer |
| Create licensing servers | Has no effect in the web application. Only super-admins can create licensing servers and external SFTP servers. | Create | CreateExternalServer |
| Edit licensing servers | Has no effect: the server never checks it. Only super-admins can edit licensing servers and external SFTP servers. | Edit | ModifyExternalServer |
| Delete licensing servers | Has no effect in the web application. Only super-admins can delete licensing servers and external SFTP servers. | Delete | DeleteExternalServer |
| Change any user's VM username | Lets the user change any user's VM username, the login name the user has on every VM. | Edit | ModifyVirtAccountInfo |
| View the logs of any VM | Lets the user see the logs that the VM controller reports for any VM. | View | GetAnyVMLogs |
| View the history of any VM | Lets the user see the event history of any VM, such as the drives attached and detached and the users added. | View | GetVMHist |
The four licensing server permissions do not control licensing servers:
tiCrypt accepts requests to view, create, edit or delete licensing servers only from super-admins, whatever
their permissions. On the server, View, Create and Delete licensing servers still control an
older list of external servers (/vm/servers) that the web application does not use, and
Create licensing servers decides whether VM hardware setup details include that list.
Slurm
| Permission | What it allows | Type | ID |
|---|---|---|---|
| View Slurm node information | Lets the user see information about Slurm nodes. | View | SlurmGetNodeInfo |
| View Slurm share information | Lets the user see Slurm share information. | View | SlurmGetShareInfo |
| View Slurm job information | Lets the user see information about Slurm jobs. | View | SlurmGetAllJobsInfo |
| View past Slurm job information | Lets the user see information about past Slurm jobs. | View | SlurmGetAllPastJobs |
| View Slurm system information | Lets the user see information about the Slurm system. | View | SlurmGetSystemInfo |
| View the Slurm partitions they can use | Lets the user (or their VM) see the Slurm partitions they can use. | View | SlurmGetAccessPartition |
| View all Slurm partitions | Lets the user (or their VM) see every Slurm partition in the system, including ones they cannot use. | View | SlurmListPartitions |
Miscellaneous
| Permission | What it allows | Type | ID |
|---|---|---|---|
| Transfer ownership of their files and drives | Lets the user give ownership of their files and drives to another user. The new owner must already have a key for the item, which means it must be shared with them. Sub-admins and higher can also transfer drives they manage, even ones they do not own. | Edit | ChangeObjectOwnership |
| Send messages about files, groups, drives and users | Lets the user post messages on files, groups and drives they can access, and send messages to other users. | Create | SendMessages |
| Read messages about files, groups, drives and users | Lets the user read the messages on files, groups and drives they can access, and the messages sent to them. | View | ReadMessages |
| Delete messages (future feature, no effect yet) | It has no effect today; it is reserved for a future feature. | Delete | DeleteMessages |
Permissions the web app does not describe yet
The tiCrypt server can have permissions that this version of the web application does not describe, for example after a backend upgrade. They are not listed in any category. Instead, a notice under the permission list names them by permission ID: "The server has permissions that this web app cannot set yet". Saving the user or profile keeps them as they were, given or not.
Permissions marked "future feature, no effect yet" are listed so that every permission the server has can be seen and kept, but they do nothing today. Giving or removing them changes nothing.
tiCrypt also has permissions for surveys, such as ListForms and CreateForm. The permission list does
not show them, so they are not covered on this page.