Roles and permissions
Six roles, what each one may do, and the actions matrix behind them. This map is the acceptance criteria for the row-level security the BI developer builds in Power BI Desktop — it does not transfer automatically, because Power BI security does not inherit from Dataverse. Edit a role or a cell to record a change request; it appears in the Not implemented list until the guard is built.
← Statement · Business rules · Roles and permissions · Changelog · Tutorials
Function head
Reads the whole function. Uses the report to decide where attention goes this week, not to manage individuals.
- See every region, i-Hub and project without a filter
- Drill through to project and person detail
- Own tolerance targets and sign off the band a measure is judged against
- Connect Excel live to the model
- See detail on a restricted project without a valid clearance
- See any financial figure — none exists in this model
- See actual or booked hours
- Operational overview
- Stages and volume
- Cycle time and delivery
Regional management
Reads one region and everything beneath it. Compares hubs inside that region.
- See every i-Hub and project in their region
- Drill through to project and person detail in scope
- Connect Excel live to the model, filtered to their region
- See other regions, even in totals
- Change a tolerance target
- See restricted detail without a clearance
- Operational overview
- Capacity
- Blockers and flow
Project engineering manager
One i-Hub, broadly. The primary audience for tolerance bands: acts on whether a measure sits inside the band.
- See every project and person in their i-Hub
- Drill through to person detail to resolve over-commitment
- Propose a tolerance target for their hub
- See other i-Hubs
- Approve a target for the function
- See restricted detail without a clearance
- Capacity
- People and the week ahead
- Blockers and flow
Project Leader
The projects they lead, plus their own allocation. Deliberately narrower than Dataverse depth.
- See the projects they lead and their own forward allocation
- Drill through to their own person detail
- See every project in their i-Hub — that view belongs to the engineering manager
- See other people's allocation
- Change any target
- People and the week ahead
- Project detail
Finance viewer
Reads the operational picture only. Financial detail is on Platform 5 and is not gated here because it is absent.
- See every region and i-Hub
- Connect Excel live to the model
- Find any cost, budget, rate or margin field — the model holds none
- Drill into restricted project detail without a clearance
- Change a target
- Stages and volume
- Cycle time and delivery
Administrator
Platform administration. Kept deliberately small; every change is logged.
- See every region and i-Hub
- Assign roles and maintain the person dimension
- Maintain clearance records
- Grant themselves restriction clearance to read restricted detail
- Change a measure definition — that is a model change, not an administrative one
- All report pages
- Roles and permissions
Action matrix
| Action | Head | Region | PEM | Lead | Finance | Admin |
|---|---|---|---|---|---|---|
| Read | ||||||
| Open the report | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| See every region | ✓ | — | — | — | ✓ | ✓ |
| See every i-Hub in their region | ✓ | ✓ | — | — | ✓ | ✓ |
| See every project in their i-Hub | ✓ | ✓ | ✓ | — | ✓ | ✓ |
| See other people's forward allocation | ✓ | ✓ | ✓ | — | ✓ | ✓ |
| Drill | ||||||
| Drill through to project detail Withheld for a restricted project without a valid clearance. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Drill through to person detail | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| See restricted project detail Clearance-gated for every role including unfiltered ones. Never granted by role alone. | — | — | — | — | — | — |
| Distribute | ||||||
| Connect Excel live to the model | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Switch a page to table view | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Govern | ||||||
| Own and approve a tolerance target | ✓ | — | — | — | — | ✓ |
| Propose a tolerance target | ✓ | ✓ | ✓ | — | ✓ | ✓ |
| Assign roles and maintain clearances | — | — | — | — | — | ✓ |
A yellow keyline marks a cell the business has changed and the build has not yet caught up with. Restriction clearance sits on top of every row in this table.
Rules that apply to everyone
- Restriction clearance applies on top of every role, including the unfiltered ones. A project without clearance is counted and named; its detail is withheld.
- No role can reach a financial figure, because no financial column exists in this model.
- No role can reach actual or booked hours. Effort is planned hours against available hours only.
- Every report consumer must exist in the person dimension, including managers with no assignments.
- EU, US and CN are separate model deployments. There is no cross-region role.
Stated divergence from Dataverse: Project Leader is narrowed from Business Unit depth (Dataverse) to projects they lead plus their own allocation (Power BI). Deliberate. Every other divergence is a defect.
Requested and not yet built
The map on this page matches what the prototype enforces.