Project Management: Best Practice for project permissions?

[DanielS]

We are just setting up the project management extension and we are wondering how we should setup the permissions settings.

Our use case:

• Every user shall have read access to all projects
• Only team members can see the tasks (and subtasks) of a project
• Exception: a project can be classified as "Confidential" --> then only the added project team members can see, read and edit in the project (and project tasks)
• Some users (our board of management) shall have read and comment access to all projects and project tasks, even if the project is classified as "Confidential" and the user has not been added as a team member (because the board of management is not part of the team).

Any suggestion how to do that?

[victor]

There is no such possibility, since there is no classic Team in the ProjectTask entity. All participants of a certain Project will see all Project Tasks depending on their Project Role and if they are added to the "Team" (not the classic one, namely Team -> Members).



And if the User is not an Admin and has not been added to Team -> Members, then he will not see Project Tasks at all.

[DanielS]

OK, but what about permission settings on project level:

• Every user shall have read access to all projects
• Exception: a project can be classified as "Confidential" --> then only the added project team members can see, read and edit in the project
• Some users (our board of management) shall have read and comment access to all projects, even if the project is classified as "Confidential" and the user has not been added as a team member (because the board of management is not part of the team).

[victor]

Every user shall have read access to all projects
Exception: a project can be classified as "Confidential" --> then only the added project team members can see, read and edit in the project

Regular EspoCRM Role don't have "team" permission for Project entity.

[yuri]

The Project scope does not have the 'team' access level intentionally. Projects and Tasks are completely isolated from Teams. Instead, project-level team members are utilized. It's a deliberate design choice (is not planned for change).

[DanielS]

This means:

Only users that have been added as team members are able to see /edit projects and according project tasks?

And if I want specific users to be able to see all projects, they must always been added as project team members (or maybe automatically added by a workflow whenever a project is created or put into status "active".

Is this the recommended solution for my use case?


Summarized:

• Every user shall have read access to all projects
  --> not possible

• Exception: a project can be classified as "Confidential" --> then only the added project team members can see, read and edit in the project
  --> this is standard behaviour of EspoCRM: by default every project is confidential, only team members can see it

• Some users (our board of management) shall have read and comment access to all projects, even if the project is classified as "Confidential" and the user has not been added as a team member (because the board of management is not part of the team).
  --> these users mustbe added as team members to each project (project role "Project Stakeholders"), maybe by an automatic workflow when a project is created

Can you confirm this as best practice?

[victor]

In any of the Projects, when creating them, add "Project Stakeholders" participants and separately for each Project the remaining participants. Within each individual project, each individual participant will have its own Project Role. If suddenly in one of the Project Tasks there are not enough rights, for example, to edit this Project Task, then you can add this User to Collaborators without changing the Project Role.

Each individual project requires individual settings and participants. If the Projects are very similar to each other, then you can simply Clone it (with or without Project Tasks and Project Members).