Enterprise Role Builder
Design an administrator workflow for composing a least-privilege role from permissions, conditions, and resource scope.
The brief
Understand the problem
Background
Enterprise permissions grow across products, resources, and actions. Broad role templates are convenient but can grant hidden capabilities through dependencies or inherited access.
User context
Administrator Tessa needs a billing analyst role that can view invoices and export monthly summaries for one region, but cannot change payment methods or inspect customer records.
Product problem
Administrators need to understand effective access and permission dependencies before assigning a custom role at scale.
Objective
Create role setup, permission composition, effective-access simulation, and publication for a scoped enterprise role.
What to design
Define the experience
Required experience
- Define role purpose and resource scope
- Add permissions from tasks or individual actions
- Test effective access for representative users
- Publish the role and review affected assignments
Screens and states
- Role setup
- Permission builder
- Effective-access simulator
- Publish review
Core user flow
Follow the critical path
- 01
Tessa names the billing analyst role and selects one region
- 02
She adds invoice read and summary export tasks
- 03
The simulator reveals that one export permission also exposes customer email addresses
- 04
She selects a redacted export alternative and publishes to a pilot group
Product rules
Requirements and constraints
Requirements
- Organize permissions by user task while retaining action-level detail
- Show inherited, dependent, conflicting, and conditionally granted access
- Simulate effective access without changing production assignments
- Summarize newly granted and removed capabilities before publication
Constraints
- Protected system roles cannot be edited
- Privilege escalation paths must be blocked
- Publication requires an authorized reviewer when sensitive permissions are included
Reality check
States worth considering
Ready-to-use content
Mock data
Use this content to test hierarchy and realistic data states. You can expand it when the concept needs more depth.
Billing permissions
- View invoices
- Export redacted summary
- Edit payment method
- View customer contact details
Scope conditions
- Region equals Southeast Asia
- Account status is active
- Export rows limited to 50,000
Finish line
What to deliver
- Four desktop screens with effective-access and conflict states
Optional direction
Visual resources
Use these as a starting constraint if you want one. They are not part of the required solution.
Open Sans & Libre Baskerville
Clear interface writing gives people the confidence to understand what changed and decide what to do next.
Open Sans & Libre Baskerville
Clear interface writing gives people the confidence to understand what changed and decide what to do next.
Theory to review
UX principles for this brief
Use these as decision lenses, then validate the design with the people and context in the brief.
usability heuristicProgressive DisclosureProgressive disclosure presents the information and controls needed now, then reveals additional detail when the user asks or the task reaches it.
heuristicTesler’s LawSome task complexity is irreducible, so design determines whether the system, the user, or an organization carries that work.
principleConstraints PrincipleWell-designed constraints limit invalid actions or make their boundaries clear while preserving valid choice and recovery.