1

The problem I currently have is: users do not understand the authorisation of the system well (i.e. what a user can do in the system depending on his roles and other things, not to be confused with authentication).

The situation:

We are developing a business system, and the business requirements towards authorisation are unfortunately rather complex.

Now, users often are confused at why they cannot see a certain object another colleague sent them, or why they cannot edit certain objects. They often ask us to tell them the roles that they currently have, but that actually doesn't really make it understandable for them. Then they want to know what roles in what configuration they would need for XYZ.

The authorisation works as follows:
Users request a role in a central role management system according to their process roles. During the request, they additionally have to select certain attributes for the role which denotes for which parts they are actually working in that role.
Our system then maps their roles to rights. Additionally, these rights may have conditions on the attributes the users selected for their role.

My request therefore:

Does anyone have examples or ideas of how it could be made more transparent to the user, so that they

  1. understand why a certain action is restricted to them
  2. know what roles in what configuration they would need to enable them to do what they wanted to.
2

The questions your user has (who can view this, and what are my current roles) can be detailed near the item to which they lack access.

I have no idea what your UI looks like, but perhaps something like the following might help get you started with some ideas.

UI detailing security level required and current user roles

I tend to find it best to be as transparent as possible to the user regarding issues like this.

| improve this answer | |
  • Thank you for your answer, I do like this idea, however, the authorisation in the system is unfortunately too complicated to be displayed like this. I'm now experimenting with a wizard where the user answers certain questions to find out what roles he needs. The first usability test produced mixed results though... – Sun Nov 27 '19 at 12:31
1
  1. If there are greyed out/inactive elements or areas that the user cannot interact with when it's restricted to them, I like to provide an explanation as to why they can't do the action. For example, on hover a popover appears with "You need to have admin access to do edit this data".

  2. Something you could test is to provide a list or type of overview of what the different roles have access to, and give the users of the system a role title.

| improve this answer | |
  • Thank you for your answer, unfortunately, the authorisation in the system is too complicated to be displayed like in your option 1. – Sun Nov 27 '19 at 12:32
  • As for option 2, I could give this a try, but also here the complexity of the authorisation is making it very difficult. – Sun Nov 27 '19 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.