1

I'm working on a UI where a site Admin can add another user role. In the mean time, we're calling this new role, "Collaborator".

The Collaborator is typically a freelancer the Admin adds to help manage their site.

Does the Admin need to be reminded that at some point, they have added a Collaborator? Just in case they need to remove this person/freelancer (for security purposes) and had forgotten to do so?

  • So the answer to your question is Yes! the admin needs to be reminded to avoid cases when he/she forgets to remove users that need to be removed. – Mo'ath Mar 26 at 17:25
  • Only you can answer this - based on "what are the consequences of not removing someone who has access to this information for X period," once you have detailed the risks, the method and process should be easier to deduce. – DarrylGodden Mar 27 at 16:14
3

What I would think would be better is to set an expiry date for the collaborator. That is if the admin knows for how long the freelancers service is needed. If the expiry date is not known from the beginning we can still have a reminder after a period of time (3,6,9,12 months ) with an auto-delete function if no action is taken.

This has been the case in a company that I worked for that had a habit of people joining and leaving the team, without deleting accounts they had the surprise of someone who left the company a while back, logged in and did some damage.

After that, they implemented this reminder with a tweak. If the user was not logging in for 1 month an admin would be notified and asked to keep or delete the user.

2

First, check if this is a valid use case to design for based on your context through answering the following questions:

  • How frequent does an admin forget to remove a freelancer?
  • In what circumstances do they forget? For example, when the contract ends? when they have too many freelancers on a single project, each with different contract periods?
  • If there're multiple admins on the site, should the admin who added the collaborator be responsible for removing?

Answering the first question will help you assess if the admin/s should be reminded at some point, whereas answering the others will help you evaluate your design options.

For as far as I understand, freelancers may have one-off or ongoing project work in a particular company. One-off contract tends to have a fixed time period, in which the freelancer should be automatically removed when the contract ends.

For security purposes

We tend to follow the principle of least privilege, so you should only grant collaborators the essential permission to get their job done. Here are some good examples:

  • Shopify separates the permission based on the tasks collaborators do. They allow collaborators, referred as partners to request access by selecting the tasks they need to get their job done. The admin then review and confirm these permissions/tasks.

  • Squarespace separates the permission based on collaborators role, only allowing admin to control such roles and permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.