Skip to main content

Divisional Management

Sub-admins are admins who manage only a sub-part of the system.

What differentiates a sub-admin is the level of visibility versus the execution.

For example, a sub-admin can make changes only to the team or project that is assigned to them, while a super-admin can make changes to all teams and projects in the system.

Assigning a task to a Sub-admin​

Admins and Super-admins assign tasks to the sub-admins via the Subadmin Managed Objects section in the tab.

This section indicates each sub-admin responsibility to a team or project.

note

Sub-admins can be assigned objects in bulk.

View Sub-admin Overlay Assigned Objects​

Subadmins can navigate to their own profile to view their current assigned objects.

To view an existing sub-admin managed object navigate to your user-name in the top right and select My profile option.

  • In the prompt, click the Sub-admin Managed Objects card.
  • View your existing sub-admin managed objects.
  • Click Close to exit the prompt.

Projects​

Sub-admins play an essential role in the projects.

They manage the members, subprojects, security requirements, and member certifications of the project independently.

Each user must be given access by a sub-admin when joining a project, either tagged or untagged.

A sub-admin can name project managers upon adding them to the project or promote existing members to project managers.

note

The difference between user and project managers is the file declassification and complete project tag removal.

All project members rely on their project memberships to be part of a project. Project memberships can be given only by the admin, the group creator, or the sub-admin assigned to run the project.

Temporary Projects​

Sub-admins should expect to work on a project temporarily. In this case, they will ask the admin to give them a project membership expiration date upon joining the project.

Once the date has expired, the sub-admin will lose access to the project unless an admin updates their memberships.

At the same time, sub-admins can register project members for a limited time using the Existing memberships option upon adding the new user.

Virtual Machines​

For every project or team assigned to a sub-admin, the virtual machine tagged by the same project or registered under the same team will be accessible to the sub-admin.

As a sub-admin, you can stop a VM if the VM is part of a team that you manage. You may execute actions at an admin level but only for the team or project assigned to you by your admin.

Teams​

Sub-admins can manage teams of users assigned to them by an admin or a Super-admin. Teams are access-based.

The sub-admin duty is to:

  • Add new members to the team.
  • Manage existing team members.
  • Monitor the limits/team quotas.
  • Make team announcements if required.

Groups​

Groups are not sub-admin-managed objects since they are private for all users.

Users can create groups no matter their role in the system.

All the features that a normal user can do can be done by a sub-admin as well. Sub-admin is a way to delegate administration without giving up full system control.

You do that by allowing sub-admins to act as admins in limited areas. Sub-admins have to do with ACLs as a general concept because of their role which influences their control in the system (similar with permissions).

The roles vs permisions: Who can change your permissions? The users with a higher role.

Sub-admins can only change the roles and permissions for the users they manage.

Certain operations are tied to the role.

You have completed the sub-admin chapter. You can practice more of the actions you learned by using tiCrypt. Optionally, you can explore Admin Management to view the differences between admin and sub-admin roles.