Learn about Flashduty’s role-based (RBAC) functional permissions and team-based data permissions design
Flashduty uses two types of permissions: functional permissions and data permissions, which work together in different feature scenarios.
You must have both functional permissions and data permissions to operate on certain data objects. Functional permissions are a prerequisite, determining whether you can perform a certain type of operation; data permissions further define the scope of data you can operate on.
Functional permissions, also known as operational permissions, determine which system features or operations a user can access. This includes: whether APIs can be called, whether buttons are clickable, and whether pages and menus are visible.
Flashduty controls functional permissions based on roles (RBAC), with permissions divided by modules for fine-grained management. The system provides the following preset roles (you can also create custom roles):
Data permissions, also known as access permissions, control the scope of data a user can access or view.
Functional permissions are a prerequisite for data permissions. You must first have the corresponding functional permissions for data permissions to take effect. For example: a member with the Viewer role belongs to Team A, and a channel belongs to Team A and is set to private. Although the member has data permissions to access this channel, since Viewer does not have channel management functional permissions, they can only view but not edit.
Flashduty controls data permissions based on teams, applied in the following scenarios:
Scenario
Permission Description
Team Management
Creator, owner account, and team members can modify team information and manage team members
Channels
Creator, owner account, and responsible team members can modify channel basic information, noise reduction configuration, escalation rules, etc.
Schedule Management
Creator, owner account, and responsible team members can modify schedule basic information, rotation rules, etc.
Template Management
Creator, owner account, and responsible team members can modify template basic information, channel template configurations, etc.
Service Calendar
Creator, owner account, and responsible team members can modify calendar basic information, holiday settings, etc.
Integration Management
Creator, owner account, and responsible team members can manage integration configurations
Mapping Rules
Creator, owner account, and responsible team members can manage mapping rule configurations
When you don’t have data permissions for a resource, the system will display the following message:
When automatically creating members through Single Sign-On (SSO) without specifying a role
Compatibility period ends: June 30, 2026After this date, API requests without specifying a role will return an error. Please complete the adaptation in advance.
Users with custom roles should check their permission configuration after the upgrade to ensure it meets expectations.
