Users, roles and permissions

DocView Capture uses role-based access control. You give each user one or more roles, and each role holds a set of permissions. A permission opens a module (for example Index / Validate), an administration page, or an operation (for example deleting pages).

You manage all of this on one page: Administration › Users & roles. You need the permission Admin.Users to open it.

If your installation has several organisations, the page shows the people of the organisation you are working in, and the roles you tick are given in that organisation only. Roles and their permissions are the same in every organisation, so only a site administrator changes the Role permissions tab.

At the top, tiles show how many users there are, how many are active, who signed in this week, the roles and the Windows accounts. Below them the page has three tabs:

Tab	What you do there
Users	Add users, change their roles, reset passwords, disable accounts.
Role permissions	Tick which permissions each role has, and add new roles.
Windows groups	Map Active Directory groups to roles. See Windows sign-in.

Add a user

Go to Administration › Users & roles and click Add user at the top right. A panel opens on the right.
Fill in:
- User name: what the person types to sign in.
- Display name: optional. The user name is used when you leave it empty.
- Email: optional.
- Password: at least 10 characters.
Click one or more Roles to select them. Operator is selected for you.
Click Add user.

Tell the user their password through a safe channel. They sign in at the address of your DocView Capture site.

Tip: If your organisation uses Active Directory, you do not need to add Windows users by hand. They are created the first time they use Sign in with Windows. See Windows sign-in.

Change a user, reset a password or disable an account

On the Users tab, click Edit on the user's row. The user opens in a panel on the right.
Change the Display name, click Roles on or off, or type a New password. Leave the password empty to keep it.
To stop someone signing in, switch Active off.
Click Save.

Windows accounts have no password field, because Windows checks their password. To sign a user out straight away, use Sign out everywhere on the Security page.

There is no delete button for users. Untick Active instead. This keeps the user's name in the audit log and in batch history.

Important: You cannot disable your own account or remove your own Administrator role. This stops you locking yourself out. Ask another administrator if you need to do this.

The list shows each user with their roles in colour, when they last signed in (for example 3 days ago; point at it for the exact time) and whether they are active. Search by name, display name or email, show one role only, or show active or disabled users only. Export downloads the users shown as Excel or CSV.

Built-in roles

DocView Capture creates four roles the first time it starts. You can change their permissions at any time.

Role	Default permissions
Administrator	Every permission.
Supervisor	Every work module, Batch Manager, Search, Reports (and managing everyone's reports), Bookings (booking in, clients and couriers), dashboard, managing batches, the audit log, and every operation.
Operator	Scan, quality check, Classification, Correction, Index, Batch Manager, Search, Reports, seeing Bookings, and the usual operations.
Verifier	Index, Verify, Batch Manager, Search, Reports, and the usual operations.

The "usual operations" are: rotate pages, move pages and documents, split and merge documents, change document class, add and delete table rows, discard changes, and suspend batches.

Note: The Administrator role always keeps Admin.Users, even if you untick it. This makes sure at least one role can manage users.

Permissions

Open the Role permissions tab. A card for each role shows its members and how many permissions it has. Below the cards, a grid shows every permission against every role, grouped by area (screens and modules, reports, bookings, batches, administration, site). Tick the boxes you want, or use All and None under a role's name, then click Save permissions.

Module and administration permissions

Permission	What it allows
`Module.Scan`	Scan and import batches.
`Module.QualityCheck`	Quality check scanned images.
`Module.Review`	Classification: classify documents and check how pages were split.
`Module.Correction`	Correction: correct one field at a time.
`Module.Index`	Index / validate documents.
`Module.Verify`	Double-key verification.
`Module.BatchManager`	View the Batch Manager.
`Module.Dashboard`	View the dashboard and reports.
`Module.Search`	Search batches, documents and page text (only in Batch Setups the role may use).
`Reports.People`	See everyone's performance: people reports, Team now and the performance targets. Without it, people reports show only one's own work.
`Module.Reports`	Run reports, build custom reports, save them for themselves or share them with their own roles, and schedule their reports (only data of Batch Setups the role may use).
`Reports.Manage`	Share reports with everyone or any role, and change, delete or schedule anyone's saved reports.
`Bookings.View`	See bookings (deliveries and collections), their boxes and the batches made from them, and print header sheets and labels.
`Module.Preparation`	Use the Preparation station to record the time spent preparing boxes for scanning.
`Bookings.Manage`	Book in deliveries and collections, edit them, change their status, and keep the client and courier lists. Booking settings need `Admin.Settings`.
`Batches.Manage`	Reroute, unlock, suspend, delete and reprioritise batches.
`Admin.BatchClasses`	Configure Batch Setups (also Lookups, Dictionaries and Scan profiles under Batch Settings).
`Admin.ImportSources`	Configure import sources and API keys.
`Admin.Users`	Manage users and roles (also the Security page).
`Admin.Settings`	Manage system settings and secrets (also the DocView Workers page).
`Admin.Audit`	View the audit log.
`Admin.CSharpScripts`	Write C# export scripts. They run on the server with the DocView Worker's rights.
`Admin.ScheduledTasks`	Create and run scheduled tasks: scripts the DocView Worker runs on a timetable after export. C# tasks also need `Admin.CSharpScripts`.

Each work module appears in the left-hand menu only for users who hold its permission. Opening a batch in a module checks the same permission.

Important: Give Admin.CSharpScripts only to people you trust with server access. A C# export script can read and write anything the DocView Worker's service account can. See C# export scripts.

Operation permissions

Operations are actions inside the work screens. Each one is a permission, and each workflow step of a Batch Setup can switch it off. An operator can use an operation only when both allow it. Buttons for operations the user may not use are hidden, and the server refuses them too.

Permission	What it allows
`Operation.DeletePage`	Delete pages from a batch.
`Operation.RotatePage`	Rotate page images.
`Operation.MovePages`	Reorder pages and documents, move pages between documents.
`Operation.SplitMerge`	Split and merge documents, make documents from loose pages.
`Operation.RejectDocument`	Reject documents so they are not exported.
`Operation.Reclassify`	Change a document's class in Index and Verify.
`Operation.EditTableRows`	Add and delete line-item rows.
`Operation.DiscardChanges`	Put a batch or document back as it was when opened.
`Operation.Suspend`	Suspend a batch from a work screen.
`Operation.DiscardBatch`	Delete batches: delete the open batch with its pages and values from Scan, Quality check, Classification, Correction, Index or Verify.
`Operation.SplitBatch`	Move chosen documents into a new batch (Split batch in Quality check, Classification, Index / Validate and Verify). See Split batches.

To switch an operation off for one step, edit the step on the Batch Setup's Workflow tab. See Workflow.

Operation.SplitBatch is different: it is off in every step until an administrator ticks Split into new batch for that step. New installations give it to the Administrator and Supervisor roles; on upgrade, roles that hold Batches.Manage get it once. Give it to operators who should split batches.

When changes take effect

Permission changes reach signed-in users on their next request. Nobody needs to sign out and in again.

Add a role

Open the Role permissions tab.
Under the grid, type a name in New role and, if you like, a Description.
Click Add.
Tick the new role's permissions in the grid and click Save permissions.

Access to Batch Setups

Module permissions say which screens a user can use. Separately, each Batch Setup says which roles may work with its batches. When a Batch Setup is created, it gives access to the built-in roles:

Role	Access to the new Batch Setup's batches
Administrator	Everything. Administrators always see every Batch Setup.
Supervisor	Everything.
Operator	Scan, import and index.
Verifier	Index and verify.

Users with Batches.Manage see the batches of every Batch Setup in the Batch Manager. The dashboard figures only count Batch Setups the user can see.

Note: A role you add yourself gets module permissions from the grid, but it is not given access to existing Batch Setups. If people in a custom role need to work on batches, also give them one of the built-in roles.

These rules apply to every password account:

Passwords need at least 10 characters.
An account locks for 10 minutes after 5 wrong passwords.
The sign-in page is rate limited.
Every sign-in attempt is recorded. See Security.

Audit trail

Every change on this page is written to the audit log: UserCreated, UserUpdated, RoleCreated, PermissionsChanged, GroupMappingAdded and GroupMappingDeleted. Filter the audit log by these actions to review who changed access and when.