Difference between not set and disabled in admin->roles->access

[Akemi]

Under administration, roles and access you can set entities on
enabled (its works and is visible),
disabled (not visible) and
not-set.

I am wondering what the difference is between disabled and not-set? Documentation says nothing about these settings.

Thanks for your effort!

[rabii]

Hi,

It means it will be skipped, see below definition based on article provided:

• “enabled” – which means that user has access to this scope;
• “disabled” – which means that user doesn’t have access to this scope;
• “not-set” – which means that it will be skipped.

You can read more about how to set up the roles and permissions here https://www.espocrm.com/tips/security-roles/

Hope this helps

[yuri]

As multiple roles are merged into one before being applied to a user, not-set scope levels will be skipped upon merging.

Examples of two roles being merged:

all + not-set = all
team + not-set = team
own + not-set = own
no + not-set = no
not-set + not-set = no

all + team = all (more permissive get a higher priority)
team + own = team (more permissive get a higher priority)

[yuri]

One role may define only certain scopes. E.g. Sales person role defines levels for Leads, Opportunities, Contacts, Accounts, but does not define for Cases, Knowledge Base Articles (these are not-set).

It makes possible applying both Sales person on Support person roles for a user. With the possibility, in the future, to make this user Sales manager, but not Support manager.

[Akemi]

Hi Yuri, thanks for your elaborate answer.
I understand the merging principle. I was looking at it from a one role perspective.

If i set for example for role sales leads on disabled, is that technically the same as not-set?
So does not-set only play a role when merging roles?

[telecastg]

Here's some more information that might help understanding how roles, teams and permissions are related.

https://forum.espocrm.com/forum/general/86258-anyone-smart-enough-to-understand-how-roles-and-teams-work-with-each-other