Permission design

Flashduty uses two types of permissions: feature permissions and data permissions, which work together in different scenarios.

📌

You must have both feature permissions and data permissions to operate on certain data objects.

Feature Permissions

📌

Feature permissions: Also known as operation permissions, these permissions determine which features or operations users can access in the system.

Flashduty controls feature permissions based on roles (RBAC). The system comes with the following preset roles (you can also customize roles):

Account.Admin: Account administrator, has all operation permissions except modifying subject information, can assist subject accounts in managing daily affairs.

Tech.Admin: Technical administrator, has access control, operation audit, and all feature permissions not listed in the table below.

Fin.Admin: Financial administrator, has permissions for billing center orders and all feature permissions not listed in the table below.

The current controllable feature permissions are shown in the following table:

Permission Point	Account.Admin	Tech.Admin	Fin.Admin
API Key Management	✔️
Operation Audit Reading	✔️	✔️
Monitoring System Event Management	✔️
Custom Field Management	✔️	✔️
Access Control - Member Management - Role Management - SSO Management	✔️	✔️
Plan Management - Plan Management - Set Balance Alert - Change Version Expiration Policy - Enable Monitoring Management	✔️		✔️
All Other Features*	✔️	✔️	✔️

💡

Note that all other features* not listed in the table (such as managing channels) are permissions that all users have by default (even if the user hasn't been assigned a role) and don't need to be controlled.

Data Permissions

📌

Data permissions: Also known as access permissions, these permissions control the scope of data that users can access or view.

Flashduty controls data permissions based on teams and applies them in the following scenarios:

Team Management: Creators, subject accounts, and team members can modify team information and manage team members.

Channel: Creators, subject accounts, and responsible team members of the channel can modify basic information, reduce noise settings, escalation rules, etc.

Schedule Management: Creators, subject accounts, and responsible team members of the schedule can modify basic information, rotation rules, etc.

Template Management: Creators, subject accounts, and responsible team members of the template can modify basic information, channel template configurations, etc.

Service Calendar: Creators, subject accounts, and responsible team members of the service calendar can modify calendar basic information, holiday settings, etc.

When you don't have data permissions for the corresponding resource, the system will show the following prompt:

FAQ

I'm an account administrator, why can't I modify channel settings?

Because channels use data permissions, you must be either the creator, subject account, or a member of the responsible team to modify the corresponding channel information.

If the channel hasn't set a responsible team, you can ask the channel creator or subject to set up a team for the channel and invite you to join, then you'll have management permissions for that channel.

Why can a member without any roles handle incidents?

Because it's common for an incident to require multiple teams working together to resolve it. Therefore, Flashduty doesn't have permission controls for handling alerts. All personnel on the platform can view and handle all alerts under the account.

However, we may implement permission controls for handling incidents in the future.

Permissions

Feature Permissions#

Data Permissions#

FAQ#

Feature Permissions

Data Permissions

FAQ