On this page (6)
A permission and a visibility scope are two independent settings: the permission says what a user can do, and the data scope says whose records they see while doing it. Confusing the two is the most common cause of the complaint ‘this report shows the wrong figures’, which in reality is not a bug at all.
The same report, different figures for two managers
The security manager at site A and the security manager at site B have the same permission: the right to open the access events report. They open the same report for the same period and see different figures, because each has a scope limited to their own site.
That is how it should be: if they saw the same thing, it would mean the scope was not working.
Permission and data scope in TraxSystem
| Setting | Answers the question | Example |
|---|---|---|
| Permission | what you may do | open a screen, save, export, open the barrier |
| Data scope | whose records you can see | site, gate, entry type, tenant company |
In TraxSystem permissions are fine-grained: 217 items in 24 groups, so a role can be put together precisely, without choosing between ‘sees everything’ and ‘sees nothing’.
That granularity has a cost, because a role put together without a plan becomes unreadable within a year. It is best to start with three or four roles that correspond to job positions instead of building a role for each person.
Where permissions and scope are most often confused
The first is exports. An XLSX file is not a way round the scope: it contains only the data the user sees on screen. That sometimes comes as a surprise to someone who was counting on ‘I’ll download everything and filter it myself’.
In a logistics park with tenants, the scope is what makes the whole thing work: a tenant sees its own vehicles and its own gate, and the park operator sees everything.
In time and attendance, permission to open a report and a scope limited to a department are two separate decisions, which together make up what the HR officer sees.
When it comes to opening the barrier, the right to register an entry, the right of access to all gates and the right to open the barrier are separate permissions, so an operator can have the first without the third.
How to set up roles and scopes step by step
- List job positions, not people.
- For each position, answer two questions separately: what should it do, and whose data should it see.
- Check the setting on a report, because a report shows faster than a configuration review whether the scope works.
- Write down who grants permissions and who removes them when an employee leaves.
What TraxSystem will not do when roles are assigned
TraxSystem will not design your roles for you, because how they are divided follows from how work is organised. Nor will it warn you that a role is too broad: giving someone full access is a technically valid operation. It cannot tell a mistake from a decision; removing a scope is recorded in the operations log, but the system will not judge whether it was justified.
Questions and answers
Can someone be given view-only access with no right to make changes?
Yes, read and write are separate permissions.
Does the administrator see everything?
Yes, if the account has administrator status: such a user sees all data regardless of the role’s scope. Everyone else sees as much as their role allows, which is why administrator status is given to a small circle of people.
Does a change of scope apply retrospectively to reports?
Yes. A report always shows data according to the current scope of the person opening it.
Who can see that someone has changed permissions?
The change goes into the operations log, with who changed what and when. This is described on the data security and personal data page.
Are roles and permissions a separate module?
No, they are part of the base system, and the pricing configurator will show you its price.
See also: The entry log and GDPR: who in the company may see driver data · A logistics park with tenants: how to separate traffic and data between companies · Time and attendance vs access control: what is the difference