Keep duties apart

Who can do this

The owner and access administrators declare and archive rules. People who read the organisation's access read them. For organisations taking part in testing roles of their own (beta).

Open in GISweaver

Choose two roles that one person should not hold together, and GISweaver keeps the duties those roles carry apart.

Part of the beta programme. Once it is on, your plan must also include separation of duties to add a new rule.

1. Open Access from Organisation controls. The Access page opens.

2. Select the Duties tab. If you see no Duties tab, select Ask GISweaver support to switch on your own roles. on the Access page.

   3. Under Add a rule from two roles, choose the First role. Under it you see the duties it carries, such as Prepare project work. 4. Choose the Second role. Under it you see the duties it carries, such as Send work outside. 5. Check Duty from the first role and Duty from the second role. GISweaver picks one duty from each role; change either if you mean another. 6. Choose Where it applies: In the same place: the same branch or project, or across the whole organisation, or Anywhere in the organisation. Your choice shows in the field. 7. Choose When a change breaks it: Refuse the change or Let it wait for a second access administrator. Your choice shows in the field. 8. Give a reason in Reason. The text shows in the field. 9. Select Add the rule. The rule appears on the tab.

What happens next

Any change that would give one person both duties is refused, or waits for a second access administrator if you chose that. See How duty rules work for which changes are checked.

People who already hold both duties are listed first under People who hold both now. Nothing is taken away from them: change their roles from People if they should not hold both.

To remove a rule, see Archive a duty rule.

If something goes wrong

• Duty rules are switched on with your own roles, which are not on for …. Your organisation is not in the beta yet. Select Ask GISweaver support to switch on your own roles. to open a ticket already written, then send it.
• A change is refused because the person would hold two duties a rule keeps apart. The refusal names both duties. Choose another person or role, or ask an access administrator to change the rule.
• Your organisation already has a rule for these two duties. Archive the existing rule first, then declare the new one.
• Sent for approval, with Waiting for approval by another access administrator. under it. The change, or archiving the rule, waits because your organisation asks for a second administrator. See Approve or reject an access change.

Details

• If your plan does not include separation of duties, no new rule can be declared. The rules you already have keep applying, and you can still archive them.
• Every rule declared or archived, every change a rule refuses and every conflict a new rule finds is written to the audit trail.