Personas and permissions

Personas and permissions are key elements in defining user access and capabilities within the system. They work together to control what users can see and do within the Commerce platform, ensuring that each user has access only to the tools and data relevant to their role.

Personas

Personas are similar to roles and define a set of permissions that a business user is authorized to perform. They represent a predefined grouping of capabilities aligned with specific business functions. Key aspects include:

Assignment

A single business user can be assigned multiple personas, allowing flexibility in access and functionality based on user responsibilities.

Distribution

Personas, along with their associated actions, may span multiple Product Business Capabilities (PBCs). When a persona includes permissions from multiple PBCs, it is stored in the datastore of each relevant PBC to ensure proper access control and functionality.

Uniqueness

To maintain uniqueness across PBCs, each Persona Action Identifier must include a PBC-specific qualifier. This ensures that action identifiers are globally distinct within the system.

Management

The Identity Service datastore is responsible for managing the relationships between business users and their assigned personas:

System personas are predefined, bootstrapped during system setup, and locked—meaning they cannot be modified by business users.
Custom personas can be created as needed, often by duplicating and modifying existing personas.
System Administrators are responsible for creating, updating, and maintaining custom personas within the system.

Permissions

Permissions determine a business user's ability to perform specific permissions on Business Objects. There are three hierarchical permission levels:

Read

Grants the ability to view a Business Object. This permission is automatically included when a user has either Edit or Manage access.

Edit

Allows modification of a Business Object, including permissions such as PUT, PATCH, and certain POST operations.

This level implicitly includes Read permission.
The user must also be assigned a persona that includes the corresponding action.

Manage

Provides full control over a business object, including the ability to update permissions and delete the object.

Implicitly grants both Edit and Read permissions.
This level is automatically assigned to the creator of a business object.