MANSOQ Knowledge
← Knowledge library

Access & roles

Clone and revise an unassigned custom role without changing the System definition

Inspect the copied role, replace its permissions with one synthetic read permission, save the custom definition and revise only its description.

Current source · Actual isolated synthetic UI operation with successful writes independently read through normal product APIs. No complete role/facility, authorization, report or printer-output qualification. · 6 min read

Before you begin

1. Inspect the unsaved cloned definition

After Clone on the built-in Billing Officer card, the Add Role form contains Billing Officer (Copy), its Facility context and 11 Selected permissions. This is an unsaved copy; the System definition remains unchanged. Review the existing name, description, contexts and permission selection before using any copied grants.

Inspect the unsaved cloned role form. Actual isolated synthetic MANSOQ application; no real patient, workforce, financial or printer records.1234
Inspect the unsaved cloned role form · 2026-10-18Actual local synthetic application on pinned source f6e9f05f. Only the pictured global role operation or Clinic configuration was observed.
  1. Unsaved copied name: Clone prepares Billing Officer (Copy), not a saved role.
  2. Copied context: Facility is selected from the source role.
  3. Copied permissions: Eleven permissions were copied; review them before saving.
  4. Clear copied permissions: Clear removes the copied selection in this form.

2. Set the approved custom identity and minimal permission set

Enter the approved name and description in the copy. This example uses SYNTHETIC Device catalogue reader and an unassigned-training description. Choose Clear, search Can List Devices, and select only Can List Devices on Facility. The lower form shows 1 Selected. In this observed intermediate state the prior required-permission message from Clear remained visible; normal Create Role submission revalidated the selected permission. The name fields are above the lower screenshot viewport and the saved result verifies them next.

Inspect the unsaved cloned role form. Actual isolated synthetic MANSOQ application; no real patient, workforce, financial or printer records.1234
Inspect the unsaved cloned role form · 2026-10-18Actual local synthetic application on pinned source f6e9f05f. Only the pictured global role operation or Clinic configuration was observed.
  1. Unsaved copied name: Clone prepares Billing Officer (Copy), not a saved role.
  2. Copied context: Facility is selected from the source role.
  3. Copied permissions: Eleven permissions were copied; review them before saving.
  4. Clear copied permissions: Clear removes the copied selection in this form.
Replace copied permissions with the single approved read permission. Actual isolated synthetic MANSOQ application; no real patient, workforce, financial or printer records.12345
Replace copied permissions with the single approved read permission · 2026-10-18Actual local synthetic application on pinned source f6e9f05f. Only the pictured global role operation or Clinic configuration was observed.
  1. Facility context: Facility is selected; other contexts are not.
  2. One selected: Only one permission is selected after clearing the copied set.
  3. Device list read: Can List Devices on Facility is the approved synthetic selection.
  4. Prior validation message: The earlier Clear message remains until normal Create Role submission revalidates.
  5. Create Role: This saves the custom definition; it does not assign a user membership.

3. Create and verify the non-System role

Choose Create Role, then verify the exact synthetic name, Facility context and one permission on its saved catalogue card. An independent normal role detail GET returned 200 and confirmed is_system false, context FACILITY and exactly can_list_devices. Saving a role definition did not assign it to a user or department.

Replace copied permissions with the single approved read permission. Actual isolated synthetic MANSOQ application; no real patient, workforce, financial or printer records.12345
Replace copied permissions with the single approved read permission · 2026-10-18Actual local synthetic application on pinned source f6e9f05f. Only the pictured global role operation or Clinic configuration was observed.
  1. Facility context: Facility is selected; other contexts are not.
  2. One selected: Only one permission is selected after clearing the copied set.
  3. Device list read: Can List Devices on Facility is the approved synthetic selection.
  4. Prior validation message: The earlier Clear message remains until normal Create Role submission revalidates.
  5. Create Role: This saves the custom definition; it does not assign a user membership.
Verify the saved non-System synthetic role. Actual isolated synthetic MANSOQ application; no real patient, workforce, financial or printer records.1234
Verify the saved non-System synthetic role · 2026-10-18Actual local synthetic application on pinned source f6e9f05f. Only the pictured global role operation or Clinic configuration was observed.
  1. Saved custom role: Confirm the exact synthetic role name and description.
  2. Context: Facility is its only saved context.
  3. One permission: Independent normal API readback confirms only can_list_devices.
  4. Custom actions: This non-System role has an Edit action in its menu.

4. Edit only the intended saved custom definition

Open the saved synthetic role’s actions menu and choose Edit. Its menu has Edit and Clone, unlike the System menu. The wide desktop Edit Role sheet shows the saved identity, Facility-only context, one selected device-list permission and the complete Update Role control. This example changes only the synthetic training description to a documented revision, then selects Update Role through the normal form. No permission or context is changed.

Open the custom role Edit action in the wide desktop catalogue. Actual MANSOQ Chrome desktop1920 by1080 synthetic training capture.12
Open the custom role Edit action in the wide desktop catalogue · 2026-10-18Actual wide desktop capture on pinned source f6e9f05f. No resized/composited image and no user membership assignment. Definition comparisons do not establish effective access.
  1. Edit this custom role: Open the saved non-System definition.
  2. Clone separately: Clone prepares a new unsaved copy.
Review the complete wide desktop custom-role form and Update Role control. Actual MANSOQ Chrome desktop1920 by1080 synthetic training capture.12345
Review the complete wide desktop custom-role form and Update Role control · 2026-10-18Actual wide desktop capture on pinned source f6e9f05f. No resized/composited image and no user membership assignment. Definition comparisons do not establish effective access.
  1. Existing role: The saved custom role name remains unchanged.
  2. Description only: Only the synthetic documentation description is revised.
  3. Same context: Facility remains the only selected context.
  4. Same permission: Can List Devices on Facility remains the one permission.
  5. Update Role: Save the reviewed custom-role update through the normal control.

5. Verify the update and unchanged grant boundary

The catalogue now begins the revised synthetic description. Independent normal role detail GET confirmed the full revision while the role name, non-System state, Facility context and single can_list_devices permission remained unchanged. No user membership was assigned. Role-definition persistence does not prove effective device access for a user.

Verify the saved wide desktop role-description revision. Actual MANSOQ Chrome desktop1920 by1080 synthetic training capture.1234
Verify the saved wide desktop role-description revision · 2026-10-18Actual wide desktop capture on pinned source f6e9f05f. No resized/composited image and no user membership assignment. Definition comparisons do not establish effective access.
  1. Saved role identity: The exact synthetic name remains unchanged.
  2. Revised description: The wide desktop revision3 description is visible on the card.
  3. Same context: Facility is unchanged.
  4. Same permission count: One permission remains; normal GET confirms its identifier.

Global role definition and customer product setup differ

The audited global role API allows authenticated list/retrieve but restricts writes to is_superuser. Built-in role updates/deletes are rejected. Separate product-setup custom-role delegation also checks context, the Facility Admin permission envelope and subscription entitlement; object-scoped patient/questionnaire delegation remains pending clinical-governance approval. Do not infer write rights from a visible menu.

Membership is a separate, scoped operation

A custom role needs an approved organizational membership before it affects a person. No membership was added in this demonstration. Reuse the existing-user linking guide for its distinct workflow, then test permitted and denied operations on the intended resources rather than relying on a role name or count.

Troubleshooting

A copied role contains more permissions than the job needs

Review every identifier and context before saving. The synthetic example clears the copied eleven and retains one device-list permission. Do not assign a broad clinical/financial set just because it was copied.

Source evidence

References are pinned to the private MANSOQ source repository. Repository access is required to open these links.