Rights reference

Manual — Users, groups and profiles · chapter 11 of 12

Each row of the permission editor is a right (a module) and each button, a level. The five common levels:

Level	Number	In general
Read	1	the item appears in the menu and the screen opens for viewing.
Edit	2	change existing records.
Create	4	register new records.
Trash	8	delete. In some modules the deleted item goes to a trash and can be restored (users, tickets); in others the deletion is permanent (groups, profiles, sites, locations).
Delete	16	erase for good what is in the trash, in the modules that have this action. Many modules do not use it.

Warning

The names are misleading: Trash is the level that deletes; Delete is “delete permanently”. For someone to be able to delete a group or a profile, turn on Trash — Delete alone is not enough.

Users, Groups and Profiles

Level	Users	Groups	Profiles
Read	list and record of the users within your reach	list and record of the groups	list, editor (viewing only) and Users and History tabs
Create	New User	+ New Group	New Profile and Clone
Edit	Edit, Deactivate/Activate, Password, assignments (Profiles tab), groups (Groups tab), emails, Reset MFA (user lost access), MFA exemption and Restore from the trash	Edit and the members (add, remove, Manager, Delegate)	Edit (name, interface, comment) and Save the permissions
Trash	Delete (goes to the trash)	delete the group (permanent)	delete a profile without users (permanent)
Delete	not used — the trash has only Restore (chapter 8)	not used	not used

• The tabs of the user record also depend on the other rights: Profiles needs Read on Profiles; Groups, Read on Groups; Tickets, Read on Tickets (table in chapter 4).
• Whoever has Edit on Users sees the profile list in registration and in the Profiles tab even without any level on Profiles.
• The administration powers — Edit/Create on Users, Profiles and Sites / Entities, and Edit on General Config — are only granted by whoever has them (chapters 5 and 10).

Tickets: visibility and special levels

The Tickets row has, besides the five levels, six special ones. Three of them decide which tickets the person sees, within the sites in reach:

Level	The person sees
See all	all the tickets of the sites in reach.
See group	the tickets in which they take part (requester, technician or watcher) and those in which one of their groups takes part.
See mine	only the tickets in which they take part.
none of the three	the same as See mine.

Level	Unlocks
Validate	requesting approval (together with Edit) and approving or refusing the ticket’s approvals.
Assign	on the ticket record, changing the status, reopening and cancelling, even without Edit on Tickets.
Own	goes to the H2O app with sync, with the other Tickets rights; the ticket record on the web does not depend on it.

System rule

The Grant all / Revoke all of the Tickets row does not touch the permission to change the priority, which has no button: it stays as it was.

Special levels of the other modules

These levels appear after the separator, on the right’s row. The details are in each module’s manual.

Right (editor group)	Special levels
Tasks (Operations)	Validate
Daily Reports (Operations)	Approve (Eng.), Approve (Mgmt.), Approve (Client) — Daily report manual
Punch list (GQE) (Operations)	Validate (Quality) — Punch list (GQE) manual
NCR (Non-conformity) (Quality (ISO))	Evaluate, Respond (supplier), See all
ISO Audit (Quality (ISO))	Issue and close, See all
Validate Requests (Warehouse)	Validate, Deliver, Return
Invoices (NFe) (Warehouse)	Approve (Eng.), Approve (Contractor) — NF-e manual
NFe Validation (Warehouse)	Approve (Eng. and Contractor)
Proposals (Finance)	Send, Approve
Estimates (Finance)	Submit for approval, Approve/Reject; on this row Delete is called Delete / Send to OrçaFascio
Contracts (Finance)	Activate, Close
Contract Measurements (Finance)	Approve, Apply deduction
Executions (Finance)	Invoice, Approve meas.
Knowledge Base (Knowledge)	Read priv., Del. priv. (private articles)