Roles

Roles determine what a person can see and do on the platform. Aerolync works with a single rule: all permissions come from roles. Someone who has platform access but no roles can log in and sees nothing. Grant a role and the matching parts of the platform appear.

You configure roles in Config > Roles and assign them to people on the Account tab of a relation.

How permissions work

Three things together decide what somebody can do:

A permission only takes effect when all three allow it. A permission for a module your organisation does not have stays switched off in the role editor, with a note that it is not included in your subscription.

Multiple roles per person are allowed. The permissions are combined: a person receives every permission granted by any of their roles. Removing one role therefore does not remove a permission that another role also grants.

System roles

Every organisation starts with four roles that Aerolync maintains. You cannot rename or delete them, but you can adjust their permissions to fit your organisation.

Assigning the Aerodrome Commander, Flight Instructor or TKI role also makes the person appear as such elsewhere in Aerolync -- for example in instructor selection lists in the scheduler and in the Pilot App.

Alongside these, you create as many roles of your own as you need: Treasurer, Secretary, Maintenance, Board member, and so on.

Permissions in a role

Permissions are grouped per module. Most modules have a view permission and one or more edit permissions; sensitive permissions are marked with a warning icon.

• View permissions show the module and its data. Someone with view rights on Fleet sees the aircraft, flight logs and defects, but changes nothing.
• Edit permissions allow changes. Edit always includes view, so you never need to switch on both.
• Sensitive permissions have consequences beyond the screen: sending invoices, releasing an aircraft to service, sending a mass mailing, exporting personal data, granting physical access, or managing roles. Grant these deliberately.

A few permissions are worth calling out:

Creating a role

1. Go to Config > Roles.
2. Click Add role.
3. Enter a name and, optionally, a short description.
4. Switch on the permissions this role needs. Work per module: first the view permission, then the edit permissions that apply.
5. Click Save.

Copying an existing role

1. Go to Config > Roles and open the role you want to use as a starting point.
2. Click Duplicate.
3. Change the name and adjust the permissions.
4. Click Save.

This is the quickest way to create variants, for example a Treasurer with and without invoicing rights.

Adjusting a system role

1. Go to Config > Roles and open the system role.
2. Adjust the permissions. The name stays fixed.
3. Click Save.

Everyone who has that role is affected immediately. A change to the Flight Instructor role therefore applies to all instructors in your organisation.

Deleting a role

1. Go to Config > Roles and open the role.
2. Click Delete.
3. If the role is still assigned to people, you are told how many. Confirm to remove the role from them as well.

System roles cannot be deleted.

Assigning roles to a person

1. Open the relation and go to the Account tab.
2. Make sure Platform Access is switched on. Without it the person cannot enter the platform, no matter which roles they have.
3. Under Roles, click Assign Role and select the role.
4. Repeat for any additional roles.

Use Show effective permissions to see exactly what the person can do once all their roles are combined.

Removing a role

1. Open the relation and go to the Account tab.
2. Find the role in the list and click the remove icon.

The person immediately loses every permission from that role, unless another one of their roles also grants it.

Common tasks

Give a treasurer access to finance only

1. Create a Treasurer role.
2. Switch on: Finance (view), transactions, invoices, wire transfers, and exports as needed.
3. Switch on Relations (view) so the treasurer can look people up.
4. Assign the role, and switch on Platform Access for the person.

The treasurer sees the Finance module and the relation list, and nothing else.

Let an instructor also do the bookkeeping

Do not extend the Flight Instructor role -- that would affect every instructor. Instead, assign this person the Treasurer role in addition to their Flight Instructor role. The permissions are combined.

Find out why someone cannot see something

1. Open the relation and go to the Account tab.
2. Check Platform Access.
3. Click Show effective permissions and look for the module in question.
4. If the module is missing entirely, your organisation may not have it in its subscription. Check Config > Roles: permissions for modules you do not have are shown greyed out.

Good practice

• Build roles around jobs, not around people. A "Treasurer" role stays usable when the treasurer changes; a role named after a person does not.
• Use multiple roles instead of exceptions. Somebody who instructs and does the bookkeeping gets two roles. That keeps both roles clean and reusable.
• Be sparing with the sensitive permissions. Invoicing, mass mailings, role management and physical access deserve a deliberate decision.
• Check the effective permissions after changes. The preview on the Account tab shows what someone can actually do, across all their roles at once.
• Keep at least two people with the Administrator role. That way your organisation is never locked out of its own platform.