Role-based access control

This section is primarily intended to guide administrators in configuring and managing access control based on user roles for Document Understanding^TM.

User roles

Document Understanding^TM has the following default roles and permissions:

• DU Administrator: acts as a service-level administrator who has permission to perform any action within Document Understanding.
  Note: DU Administrators can only assign roles if they also hold the position of Organization Administrator. This can occur in two scenarios:

  • If the DU Administrator role was inherited as part of the Administrator group at Organization level, it works as expected. Any user part of the Administrator group in Automation Cloud^TM is automatically an Organization Administrator.
  • If the DU Administrator role was explicitly assigned (for example, to a user that is part of the Everyone group in Automation Cloud^TM), the user can perform all tasks in Document Understanding as defined by the DU Administrator role, except Role Assignments.
• DU Data Annotator: has permission to view projects and annotate documents, or edit fields, but can't delete data from document types or publish project versions.
• DU Developer: acts as a project-level administrator who has permission to perform any action within a project.
• DU Model Trainer: has permission to modify certain document type settings and delete or upload documents.
• DU Viewer: has permissions to view certain features, but can't modify any settings within a project.

Inheritance of organization roles

Organization roles are automatically mapped to Document Understanding roles.

Table 1. Organization roles inheritance

Tenant role	Document Understanding role
Administrators	DU Administrator
Automation Developers	DU Developer
Automation Users	DU Viewer

Organization Administrators are automatically granted DU Administrator privileges. This applies to all other roles mentioned in the table above. However, you can't currently remove or delete automatically assigned roles. For instance, if you want only a specific subset of organization admins to have DU Administrator privileges, this feature is not available at this time. You can explicitly assign the DU Administrator role to a user outside of the Administrator group, but they will not have access to manage role assignments.

Managing and assigning roles

To manage overall access and roles for Document Understanding, select the Manage access button at the top-right of the screen.

Figure 1. Document Understanding manage access

To manage access for a specific project, open that project and go to the Manage access section at the bottom-left of the screen.

Figure 2. Project manage access

User roles and permissions

Setting up different roles, assigning specific access rights, and managing users ensure that each user within your organization has the type of access suited to their professional requirements, upholding data integrity and enhancing system security.

On the Manage Access page you can see four types of roles with their appropriate permissions:

• Document Understanding Administrator: administrator, has all permissions.
• Document Understanding Data Annotator: can view projects, label documents, edit fields, but can't delete data from Document Types or publish project versions.
• Document Understanding Developer: can read projects and can manage anything inside a project: classifiers, extractors, document types. Cannot create or delete projects.
• Document Understanding Model Trainer: can view projects, label documents, edit fields, import or export data and delete data from a Document Type session.
• Document Understanding Viewer: can view all entities but has no rights to edit or delete them.

Document Understanding Administrator permissions

Permission	Description
Classifier.Create	You can create a new classifier.
Classifier.Delete	You can delete an already available classifier.
Classifier.Read	You can read the classifier.
Classifier.Update	You can update a classifier that is already available.
DataSetExport.Create	You can export a dataset.
DataSetExport.Delete	You can delete a dataset export.
DataSetExport.Read	You can read an available dataset export.
Documents.Delete	You can delete documents.
DocumentType.Create	You can create new document types.
DocumentType.Delete	You can delete document types.
DocumentType.Read	You can read an already available Document Type.
DocumentType.Update	You can update a document type that is already available.
Extractor.Create	You can create a new extractor.
Extractor.Delete	You can delete an already available extractor.
Extractor.Read	You can read the extractor.
Extractor.Update	You can update an extractor that is already available.
MonitorProcessedDocuments.Read	You can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.Read	You can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.Read	You can read the Projects Performance dashboard from the Monitor section.
Project.Create	User can create new projects.
Project.Delete	You can delete an already available project.
Project.Read	You can read the project.
Project.Update	You can update an already available project.
ProjectVersion.Create	You can create new project versions.
ProjectVersion.Delete	You can delete an already available project version.
ProjectVersion.Read	You can read a project version.
ProjectVersion.Update	You can update an already available project version.
ProjectVersionLabel.Create	You can create new project version labels.
ProjectVersionLabel.Delete	You can delete an already available project version label.
ProjectVersionLabel.Read	You can read a project version label.
ProjectVersionLabel.Update	You can update an already available project version label.
TenantSettings.Create	You can create Document Understanding tenant level settings.
TenantSettings.Read	You can read Document Understanding tenant level settings.
TenantSettings.Update	You can update Document Understanding tenant level settings.

Document Understanding Data Annotator permissions

Permission	Description
Classifier.Read	You can read the classifier.
DocumentType.Read	You can read an already available Document Type.
DocumentType.Update	You can update a document type that is already available. You can update anything inside a particular document type (for example, documents, annotations, fields, and others). You can also delete document types.
Extractor.Read	You can read the extractor.
MonitorProcessedDocuments.Read	You can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.Read	You can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.Read	You can read the Projects Performance dashboard from the Monitor section.
Project.Read	You can read the project.
ProjectVersion.Read	You can read a project version.
ProjectVersionLabel.Read	You can read a project version label.

Document Understanding Developer permissions

Permission	Description
Classifier.Create	You can create a new classifier.
Classifier.Delete	You can delete an already available classifier.
Classifier.Read	You can read the classifier.
Classifier.Update	You can update a classifier that is already available.
DataSetExport.Create	You can export a dataset.
DataSetExport.Delete	You can delete a dataset export.
DataSetExport.Read	You can read an available dataset export.
Documents.Delete	You can delete documents.
DocumentType.Create	You can create new document types.
DocumentType.Delete	You can delete document types.
DocumentType.Read	You can read an already available Document Type.
DocumentType.Update	You can update a document type that is already available. You can update anything inside a particular document type (for example, documents, annotations, fields, and others). You can also delete document types.
Extractor.Create	You can create a new extractor.
Extractor.Delete	You can delete an already available extractor.
Extractor.Read	You can read the extractor.
Extractor.Update	You can update an extractor that is already available.
MonitorProcessedDocuments.Read	You can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.Read	You can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.Read	You can read the Projects Performance dashboard from the Monitor section.
Project.Read	You can read the project.
Project.Update	You can update an already available project.
ProjectVersion.Create	You can create new project versions.
ProjectVersion.Read	You can read a project version.
ProjectVersion.Update	You can update an already available project version.
ProjectVersionLabel.Read	You can read a project version label.

Document Understanding Model Trainer permissions

Permission	Description
Classifier.Read	You can read the classifier.
Documents.Delete	You can delete documents.
DocumentType.Read	You can read an already available Document Type.
DocumentType.Update	You can update a document type that is already available.
Extractor.Read	You can read the extractor.
MonitorProcessedDocuments.Read	You can read the processed documents from the Monitor section.
MonitorProcessedDocumentsDetail.Read	You can read the processed documents detail from the Monitor section.
MonitorProjectPerformance.Read	You can read the Projects Performance dashboard from the Monitor section.
Project.Read	You can read the project.
ProjectVersion.Create	You can create new project versions.
ProjectVersion.Read	You can read a project version.
ProjectVersion.Update	You can update an already available project version.
ProjectVersionLabel.Read	You can read a project version label.

Document Understanding Viewer permissions

Permission	Description
Classifier.Read	You can read the classifier.
DocumentType.Read	You can read an already available Document Type.
Extractor.Read	You can read the extractor.
MonitorProcessedDocuments.Read	You can read the processed documents from the Monitor section.
MonitorProjectPerformance.Read	You can read the Projects Performance dashboard from the Monitor section.
Project.Read	You can read the project.
ProjectVersion.Read	You can read a project version.
ProjectVersionLabel.Read	You can read a project version label.