Roles
A role has a collection of rules that are used to restrict or allow users to access Views, Processes or Environments.
There are multiple types of Rules:
AllowAction - This rule describes the activities that the user in the role can do
DenyAction - This rule describes the activities that the user in the role explicitly cannot do
AllowTag - This rule allows the users in the role to only see Processes with a specific Tag.
DenyTag - This rule explicitly hides the Processes with Tags.
AllowEnvironment - This rule allows the users in the role to only see the Environment given.
DenyEnvironment - This rule explicitly hides the Environment given for the users in the role.
There can be multiple roles, and each role can have multiple allow or deny rules. There is no hierarchy between the roles. If a user belongs to multiple roles that have different rules defined, the rules from each role are combined.
The next article is Introduction to Limit access to Views and actions - Activity