WEBVTT

1
00:00:00.000 --> 00:00:02.464
The training organisation wants a reviewer to

2
00:00:02.479 --> 00:00:06.140
inspect findings without managing payments. We will

3
00:00:06.156 --> 00:00:09.817
separate role permissions, individual overrides and file

4
00:00:09.832 --> 00:00:11.969
scope. A role is a set of

5
00:00:11.969 --> 00:00:14.438
permissions. Open its details to see what

6
00:00:14.443 --> 00:00:16.762
it grants, rather than assuming its display

7
00:00:16.767 --> 00:00:19.461
name fully describes its authority. List the

8
00:00:19.470 --> 00:00:22.884
actions the person needs: viewing files, reviewing

9
00:00:22.893 --> 00:00:27.342
findings, requesting co-sign or final certification. Grant

10
00:00:27.351 --> 00:00:30.367
only the capabilities appropriate to that job.

11
00:00:30.506 --> 00:00:33.272
A review task does not automatically require

12
00:00:33.281 --> 00:00:37.158
billing administration. Keep these responsibilities separate unless

13
00:00:37.167 --> 00:00:40.646
the organisation intentionally assigns both. Permission to

14
00:00:40.660 --> 00:00:42.736
perform an action and permission to see

15
00:00:42.750 --> 00:00:47.000
a file are separate checks. Organisation, partner-company

16
00:00:47.098 --> 00:00:50.261
and own-file scope can produce different visible

17
00:00:50.275 --> 00:00:53.105
records. A member can have permission adjustments

18
00:00:53.117 --> 00:00:55.936
beyond the role. Review those overrides when

19
00:00:55.936 --> 00:00:58.499
their effective access differs from other people

20
00:00:58.510 --> 00:01:00.820
with the same role. Someone can open

21
00:01:00.834 --> 00:01:03.344
a file yet lack permission to certify

22
00:01:03.358 --> 00:01:06.878
it. The file's status and separation-of-duties rules

23
00:01:07.060 --> 00:01:09.510
can also prevent the action. Review the

24
00:01:09.520 --> 00:01:12.753
proposed role or member changes before saving.

25
00:01:12.883 --> 00:01:15.196
A broad role update can affect several

26
00:01:15.206 --> 00:01:17.488
members, not just the person whose problem

27
00:01:17.488 --> 00:01:20.677
you are investigating. Use permission change history

28
00:01:20.695 --> 00:01:23.829
and activity records to understand who changed

29
00:01:23.847 --> 00:01:26.544
access. Do not rely solely on a

30
00:01:26.561 --> 00:01:29.156
screenshot of the current role. Pause here.

31
00:01:29.570 --> 00:01:31.658
A training reviewer sees a file but

32
00:01:31.749 --> 00:01:35.048
cannot approve it. Check permission, file scope,

33
00:01:35.099 --> 00:01:37.953
current status and signer independence in that

34
00:01:38.045 --> 00:01:38.599
order.