Document Template Security Group Category Inheritance

Security rights can now be assigned directly to document template categories such that each document template in the category inherits rights from the category, which can make assignment and maintenance of rights much more efficient. For example, if a category has 10 document templates and the security access is the same for every document template in the category, the effort to assign and maintain the rights will be one-tenth of what it was previously. For more information, click <here> to access the "Configuring Document Template Security" topic of the "Admin Help" guide.

PowerSchool Special Programs Version 20.6 introduces functionality designed to allow document rights to be assigned to security groups in a much more efficient manner. With Version 20.6, security rights can now be assigned directly to document template categories such that each document template in the category inherits rights from the category. For example, if a category has 10 document templates and the security access is the same for every document template in the category, the effort to assign and maintain the rights will be one-tenth of what it was previously. The following rules apply:

Any rights assigned at the category level are automatically applied to each document template in the category, although if there is a document template in a category that needs to have distinctly different rights than other document templates, it is possible to disable inheritance for an individual document template via a “Do Not Inherit Rights from Category” option described later in this section.
Rights not assigned at the category level can be assigned directly to one or more document templates in the category. Therefore, the actual rights applied to a document template may include those assigned to the category and directly to the document template.
Upon upgrade to 20.6, existing rights will remain assigned to document templates in order to preserve existing access.

System administrators familiar with existing security rights assignment screens will find that the changes in the UI are very straightforward:

To view/edit all rights for a document template category, click Administration > Configuration > Document Templates. Observe that there is a padlock icon next to each category that you can click to assign rights to the category.
If you click the padlock icon for an individual document template, any rights inherited from the category will show as read-only checkboxes that are selected. It is not possible to clear the checkbox for an individual right inherited from the category; however, it is possible to turn off inheritance for an entire document template by clicking the “Other Security Options” tab and then selecting the “Do Not Inherit Rights from Category” checkbox.
To see an overview of all document-wide rights assigned to a particular security group (through a category or individual document template), click Administration > Security > (any security group) > Document Templates (tab). Note that you can drill into a category and assign rights for it. If you return to the summary, you can see that it shows the rights assigned directly to the category and illustrates how the rights inherit down to the document templates in the category.

There are a few special cases that may surface in certain troubleshooting situations.

“View” and “View Final Only” are mutually exclusive rights. You cannot assign “View” at the category level and then assign “View Final Only” to a document template in that category, or vice-versa (unless the document template has the “Do Not Inherit Rights from Category” option enabled).
Document templates that use “document owner” security will not inherit from the category and will always have the “Do Not Inherit Rights from Category” option locked on. If you click the “Other Security Options” tab and see that the “Do Not Inherit Rights from Category” checkbox is selected and disabled, this is the reason why.

The intention of security right inheritance is to make it easier for Services and the customer to assign rights.

In addition to being able to manage security at the Document-Wide and Section-Wide level, security rights can now be assigned at the Document Template/Categories level, where document templates within a category will inherit the rights assigned at the category level.

Administrators can specify rights for individual document templates that are different from the "Inherited from category" rights.

Administrators can grant additional rights for individual document templates than those which are inherited from the category-level rights.

Document templates are not required to be part of a category. Any document templates which are not grouped into a category are listed in the "Other Document Templates" section at the bottom of the Document Templates/Categories column.

Log in as the System Administrator, and then select Administration > Security.
Click the name of the security group you are interested in.
Click the Document Templates tab.
Review the overview grid. This allows you to see which rights the security group has to which documents.
1. Solid black circles indicate document-wide rights.
2. Unfilled circles indicate that the security group only has the corresponding right to view certain sections of the document.
3. Solid gray circles indicate that security rights are inherited from the category.
On the Template Security page, edit the document-wide rights for the security groups listed in the left-hand column and click Save Changes. These rights are explained in detail in the Template Security Rights section following this procedure.
You can also click the Other Security Options tab which allows you to set some additional options as described below.

Establish security access for document templates

Log in as the Security Administrator, and then select Administration > Configuration.
Click the Document Templates tab.
Click the magnifier icon next to the document template for which you want to establish security.
On the Document Templates page, click Security (located at the top of the screen) to establish which groups will have document-wide privileges for documents of this type. For the procedure to assign access to individual sections only, see Establish security access for an individual section of the template.

Note: If you have a lot of security groups, you may find it convenient to filter the list by clicking a letter in the alphabetical row of buttons. The list will be filtered to groups with a name that starts with that letter.

Alternate approach to managing template security rights

You can also navigate to a security group and manage the rights for that security group across all document templates. For an illustration of this alternate approach, follow the steps below:

Log in as the System Administrator, and then select Administration > Security.
Click the name of the security group you are interested in.
Click the Document Templates tab.
Review the overview grid. This allows you to see which rights the security group has to which documents. The solid black circles indicate document-wide rights whereas the hollow circles indicate that the security group only has the corresponding right to view certain sections of the document.
In the Select Template field, use the drop-down menu to select any document template and review/edit the template rights the security group has for that document template.
Click the (Edit) link on the left side of the Document Wide View/Edit Rights section to edit the document-wide rights.
Click the (Edit) link on the left side of the Section Wide View/Edit Rights section to edit the section-wide rights.

In the Select Templates/Category drop-down menu, select the (category).