Docs/Roles Permissions/Assigning Roles — SanadiqCloud

Assigning Roles — SanadiqCloud

Product version: 1.0.0+1
Last updated: 2026-08-03
Audience: Tenant Owners and users with role:assign / tenant:user:update

A. Where Assignment Happens

Assignment is a full page, not a dialog:

Entry Result
Members list → Assign Opens /settings/users-roles/assign
Member detail → Assign role Same assign page
Roles area → assign flow Same assign page (may show member picker)

Path: /settings/users-roles/assign.

B. Assign Flow

  1. Open Team > Members (or member detail).
  2. Choose Assign role.
  3. On the assign page: - Member may be prefilled or selected from a picker. - Role list is a single-select list (radio). The member's current role is pre-selected. - Owner users and owner-type roles are excluded from assignable options.
  4. Submit — the previous role is replaced by the selected role.
  5. Success snackbar; page pops with success so the members list can reload.

There is no multi-role assignment: each member has exactly one business role per organization.

C. Effects

  • Permission checks use the updated role set on subsequent requests.
  • Users do not need a dedicated “sign out to refresh roles” step in the product UI.
  • Removing all useful roles can leave the member unable to use gated features (unauthorized screens).

D. Owner Protection

You cannot assign roles onto / strip the protected Tenant Owner membership through the normal assign/remove actions.

E. Best Practices

Practice Detail
Prefer custom roles for specialties Keep built-in roles as baselines
Least privilege Grant only what the job needs
Verify after change Have the member open a gated screen to confirm
Use audit Role changes appear in audit where enabled

Related: Members | Custom Roles | Overview