# Case app (Modern) permissions reference

> Look up the Case permission required for each Case app (Modern) feature, and where administrators grant Case roles and Orchestrator folder roles.

This page lists the Case permission required for each feature in [Case app (Modern)](modern-case-app.md), and where an administrator grants it. [Case app (Legacy)](case-app.md) applies no persona or role scoping.

## Where permissions are granted

Case app (Modern) access comes from two kinds of role. Most features need a **Case role**. A few still need an **Orchestrator folder role**.

| Label | What it grants | Who sets it up | Where |
| --- | --- | --- | --- |
| **Case role** | Permissions on the cases of one case process. The scope is either the whole case or specific stages. | Case designer (define) | Studio Web → **Case roles** dialog of the case |
|  |  | Case administrator (assign) | Maestro Orchestrate → **Processes** → **Access** tab of the case process |
| **Folder role** | Orchestrator permissions in a folder, such as tasks, processes, logs, and apps. | Orchestrator or folder administrator | Orchestrator → **Folders** → **Manage access** of the folder that holds the case process |
| **Admin** | Users and groups | Organization administrator | Administration → **Accounts and groups** |

### Setting up access

1. In Studio Web, open the case and the **Case roles** dialog. Add or edit a role, then select its permissions and its scope: the whole case or specific stages.
2. Publish and deploy the solution. Deploying creates the Case roles but doesn't assign them to anyone.
3. In Maestro Orchestrate, go to **Processes**, open the case process, and select the **Access** tab. Assign users or groups to each role.
4. For features that need a folder role, go to Orchestrator → **Folders**, select the folder that holds the case process, then select **Manage access** → **Assign role**. Use a built-in role, such as Folder Administrator, Automation Developer, or Automation User, or a custom folder role.

Assigning a role to a group gives it to every member of that group.

:::note
Roles are read-only on the **Access** tab. To change a role's permissions, edit the case in Studio Web and republish.
:::

## Case role scope rules

* **Whole case** — the permissions apply to the case itself and to every stage in it.
* **Specific stages** — only these permissions take effect at stage scope:
  * **View**
  * **Assign**
  * **Manage SLA**
  * **Run manually triggered tasks**
* These permissions always need a whole-case grant, and a stage grant is refused:
  * **View summary**
  * **Close**
  * **Reopen**
  * **Select stage**
  * **View logs**
  * **Manage**
* A stage-scoped **View** lists every case of that process, with all of its stages, in every lifecycle state. Opening a case's details also needs **View summary**, which needs a whole-case grant — so a stage-only role can see cases in lists but can't open them.
* Roles add up. A user with several roles has every permission that any of those roles grants.

## Permissions by feature

The **Permission** column gives the label shown in the Studio Web **Case roles** dialog, with the technical name in parentheses.

### App home and apps

| Feature | Permission required | Scope | Granted via |
| --- | --- | --- | --- |
| See an app on the home grid and open it | View (`Cases.View`) on at least one case process in the app | Whole case or any stage | Case role |
| Pick case processes in the New / Edit app dialog | Processes – View (`Processes.View`) | Folder | Folder role |
| Create an app | Apps – Create (`Apps.Create`) and View (`Cases.View`) on every case selected | Apps: any folder. `Cases.View`: on each case (whole case or stage). | Folder role (Folder Administrator or Automation Developer) and Case role |
| Edit an app | Apps – Edit (`Apps.Edit`) and View (`Cases.View`) on every case already in the app and every case being added | Same as creating an app | Same as creating an app |
| Delete an app | Apps – Delete (`Apps.Delete`) and View (`Cases.View`) on every case in the app | Same as creating an app | Same as creating an app |
| Personal settings: theme, language, app order, pinned cases, column visibility | None — your own user settings | — | — |
| Home dashboard, handler view: volume chart, task SLA, open actions | View (`Cases.View`). The open-actions part also needs the task permissions under Actions (tasks) below. | Whole case or stage | Case role |
| Home dashboard, owner view: case volume, case-type distribution, SLA breakdown, resolution time; the **Open in Maestro** button | Manage (`Cases.Manage`) | Whole case only | Case role |

### Cases list

| Feature | Permission required | Scope | Granted via |
| --- | --- | --- | --- |
| Cases list: rows, stage and task columns, last activity, summary cards, case-type and stage filters, pinned cases | View (`Cases.View`) and membership of at least one Orchestrator folder | Whole case or any stage | Case role and folder role (any role) |
| Filter by case variable; case-variable columns | View (`Cases.View`) and membership of the folder that holds the case | Folder | Case role and folder role (any role) |
| Share a variable-column layout with everyone in the app | Apps – Edit (`Apps.Edit`) and View (`Cases.View`) on every case in the app | Same as editing an app | Folder role and Case role |

### Case details

| Feature | Permission required | Scope | Granted via |
| --- | --- | --- | --- |
| Open a case: header, SLA, case plan and description, overview, element executions, incidents | View (`Cases.View`) and View summary (`Cases.ViewSummary`) | Whole case only for View summary | Case role |
| Stages: timeline and stage board | View (`Cases.View`) | Whole case or any stage | Case role |
| Activity trail and execution traces (Activity tab) | View logs (`Orchestrator.Logs.View`) | Whole case (Case role) or the case's folder (folder role) | Case role or folder role. Folder Administrator and Automation Developer include it; Automation User doesn't. |
| AI summary card | Opening the case; must also be turned on in the case design | — | Studio Web case settings |
| Close a case | Close (`Cases.Close`) | Whole case only | Case role |
| Reopen a case | Reopen (`Cases.Reopen`) | Whole case only | Case role |
| Select the next stage or start a stage | Select stage (`Cases.SelectStage`) | Whole case only | Case role |
| Add a manual action or start a planned task | Run manually triggered tasks (`Cases.RunAdhocTasks`) | Whole case, or the stage that owns the task | Case role |
| Case agent chat | Opening the case, plus permission to see and run the conversational agent in the case's folder; must also be turned on in the case design | Folder | Folder role |

### Actions (tasks)

Task access comes from Orchestrator folder roles, using the Action Center permissions model. All permissions are checked in the folder that holds the task — the case's folder. The Actions page also needs View (`Cases.View`) through a Case role.

| Feature | Permission required (folder of the task) | Built-in folder roles that include it | Granted via |
| --- | --- | --- | --- |
| My actions, plus the Actions tab and card on a case: tasks assigned to you or a group you belong to | Tasks – View (`Tasks.View`) | Folder Administrator, Automation Developer, Automation User | Folder role |
| See unassigned tasks and **Assign to me** | Tasks – View + Edit, and Task self-assignment – Create (`TaskSelfAssignment.Create`) | Folder Administrator, Automation Developer, Automation User | Folder role |
| Open and complete a task | Tasks – View + Edit. You must also be the assignee, or a member of the assigned group. | Folder Administrator, Automation Developer, Automation User | Folder role |
| Manage view: every task in the app, whoever it's assigned to | Tasks – View + Edit, and at least one task assignment permission (Create, Edit, or Delete), all in the same folder | Folder Administrator, Automation Developer (not Automation User) | Folder role |
| Assign an unassigned task to someone else | Tasks – View + Edit, and Task assignment – Create (`TaskAssignment.Create`) | Folder Administrator, Automation Developer | Folder role |
| Reassign a task to someone else | Tasks – View + Edit, and Task assignment – Edit (`TaskAssignment.Edit`) | Folder Administrator, Automation Developer | Folder role |
| Who appears in the assignee picker | Users who hold Tasks – View + Edit in the task's folder | — | Folder role for the assignee |

## Related topics

* [Case app (Modern)](modern-case-app.md)
* [Case app](case-app.md)
* [Implementing stage-level personas and permissions](how-to-implement-stage-level-personas-and-permissions.md)