How access works
Three things combine:
Role: the permissions you have on each kind of item, such as portfolios, initiatives or financial lines;
Space: a part of your organization, such as a region or business unit. Spaces form a tree under your organization root. Every portfolio belongs to a Space, and the Space controls who can see it;
Binding: the link that gives a WorkBoard group or a single user one or more roles in a Space.
On top of this, a portfolio or initiative can be shared with specific people at View or Edit. Sharing only adds access; it never takes any away.
The built-in roles
SPM comes with twelve built-in roles. Administrators can see exactly what each role can do in SPM Admin → Roles, under Roles & rights. Rights are shown per item type as r (read), w (write), m (manage) and a (admin). Administrators can also create their own roles there (see Custom roles below).
Role | Permissions |
Super Admin | Read, write, manage and admin on every item type, including platform and Space configuration. |
IT Admin | Platform configuration and Space configuration only. No rights on portfolios, initiatives or any other business data. |
PMO Admin | Read, write and manage on portfolios, initiatives, roadmaps, intake requests and Space configuration, and full rights on signals. Read on programs, scenarios, risks, decisions, financial lines and resources. |
Portfolio Manager | Read, write and manage on portfolios, initiatives, programs, scenarios and roadmaps, and full rights on signals. Read and write on risks, decisions, intake requests, financial lines and resources. |
Portfolio Owner | Read and write on portfolios, initiatives, programs, roadmaps, scenarios, risks, decisions, intake requests, financial lines and resources, for the portfolios they own and what belongs to them. |
Initiative Manager | Read and write on every initiative in their Space and on its programs, roadmaps, scenarios, risks, decisions, intake requests, financial lines and resources; read, write and manage on signals. Read on portfolios. |
Initiative Owner | Read and write on initiatives, programs, roadmaps, scenarios, risks, decisions, intake requests, financial lines and resources, for the initiatives they own and what belongs to them. Read on portfolios. |
Contributor | Read and write on initiatives, programs and roadmaps. Read on portfolios, scenarios, risks and decisions. No rights on financial lines, resources or intake requests. |
Requester | No rights on any SPM item type. Requesters submit requests and follow their own. |
Executive | Read on everything, including the executive dashboard (the Brief). |
Viewer | Read on everything except the executive dashboard. |
Member | No rights from the role itself. A Member sees only the portfolios, initiatives and roadmaps that have been shared with them. |
Custom roles
On SPM Admin → Roles, Super Admins can:
Select New role to create a role: give it a Role name, choose the Space it applies in (or All Spaces), and set its Rights by object type. You can start from blank or copy an existing role.
Select New permission to add a new object type as a column in the grid, with default access for each role.
Use the actions menu on a custom role to edit or Archive it.
Spaces and bindings
When an administrator creates a binding, Include descendants decides whether it also covers the Spaces below the chosen one.
Create a Space
Open SPM Admin, then the Spaces tab.
Under New Space, enter a Name and choose the Parent (it defaults to the root).
Select Add Space.
The Space tree shows each Space and its reporting currency. A Space set to Inherit uses its parent's currency.
Set up a binding
Open SPM Admin, then the Access bindings tab.
Under Bind a group or user to a role & Space, choose the Subject type: WB group or User.
Pick the group or user, choose one or more Roles, and choose the Space.
Set Include descendants.
Select Add binding.
Current bindings lists one row per person or group, with their Roles, the Space · Subtree they apply to and the number of bindings. Select + Role on a row to give that person or group another role. The Users tab lists each person with their roles and the Space each role applies to.
Tips
Bind groups rather than individual people where you can, so access follows group membership;
Bind executives at the organization root, so every Space is in scope
Have at least two Super Admins, so setup and access recovery never depend on one person.
FAQ
Why can a colleague see a portfolio I can't?
The portfolio's Space controls who can see it, and it may also have been shared with them. Compare your bindings with theirs on SPM Admin → Users or Access bindings.
Can I give someone access to just one portfolio?
Yes. Open the portfolio, select the Share icon in the header and add the person at View or Edit. They also get the same access to the portfolio's initiatives.
Where do I check what a role can do?
SPM Admin → Roles shows the rights of every role on every item type.