Permissions
Important: This feature is currently in open beta. For more information, see the Nintex Beta terms document. If something is not functioning correctly, please raise this with support@nintex.com
Nintex Processes permissions determines who can access, edit, and manage processes in your organization.
Access is controlled by these three things:
-
Where the process is in the folder tree.
-
What state the process is in (unfiled, filed, draft, or published).
-
Which access role the user holds.
Folder permissions form the basis of your access. They can be viewed as 'groups'. You do not grant a user access to a process, you grant that user access to a folder, and every process inside that folder, along with the content of every sub-folder beneath it.
Access permissions funnel
Access becomes more restricted as you move down the folder hierarchy, with each subfolder potentially granting access to a smaller audience.
A user must have access to a folder before they can be granted access to any of its subfolders. As a result, permissions are always assigned from the top down. In practice, the people picker for a subfolder displays only users who already have access to its parent folder.
Folder creation rights are deliberately split. Only a Platform Admin An access permmissions role. The administrator role in Nintex Processes who can create root folders, manage workspace and folder access, create and edit drafts, publish where permitted, archive, restore and permanently delete processes. can create a root level folder, which keeps the top level of the workspace under workspace-level control. Below that, only a folder Owner An access permission role. The folder Owner role in Nintex Processes can manage folder settings, access, permission sets, inheritance and sub-folders; create, edit, publish and archive within owned folders, and assign Process Owner or Process Expert roles to a process. can create sub-folders inside a folder they own. Designer An access permissions role. A Designer in Nintex Processes can create processes outside a folder, design and edit drafts, publish where permitted, and assign Process Owner or Process Expert roles to a process. and Contributor An access permisions role. A Contributor in Nintex Processes can view, create, edit and publish processes and filed drafts in assigned folders, assign Process Owner or Process Expert roles to a process, and archive in assigned scope. roles can only create processes, never folders.
The order in which you create folders is important because each level inherits the access permissions granted by its parent folder.
-
A Platform Admin An access permmissions role. The administrator role in Nintex Processes who can create root folders, manage workspace and folder access, create and edit drafts, publish where permitted, archive, restore and permanently delete processes. creates the root folder. This is the only step nobody else can do.
-
Assign at least one folder Owner immediately. Managing everything below this point is the responsibility of the folder owner, and the folder prevents you from removing the last owner later..
-
The folder Owner grants access at the top level. Decide who is a Viewer An access permisions role. The user can view published processes., Contributor An access permisions role. A Contributor in Nintex Processes can view, create, edit and publish processes and filed drafts in assigned folders, assign Process Owner or Process Expert roles to a process, and archive in assigned scope. and Designer An access permissions role. A Designer in Nintex Processes can create processes outside a folder, design and edit drafts, publish where permitted, and assign Process Owner or Process Expert roles to a process.. Granting access permissions here is what makes those people eligible for process roles further down in the sub-folders.
-
Create sub-folders. They inherit the parent folder’s access permissions list by default. Leave them inherited unless there is a reason not to.
-
Break inheritance only when the audience genuinely differs. Keep in mind that permission changes cascade to all child items, and disabling inheritance creates a standalone access permissions list that must be managed manually.
-
Finally, assign your process specific roles: Process Owners A process role. A Process Owner in Nintex Processes is responsible for managing the lifecycle of the process. and Process Experts A process role. A Process Expert in Nintex Processes is responsible for keeping the process definition updated to match how the organization actually functions.. Only users who already hold visibility and edit permissions on the process can be selected, so you must grant folder access first.
When you create a folder, the Inherit access from parent folder toggle is on by default. Breaking inheritance by turning that toggle off detaches this sub-folder from the access permissions of the parent. The folder then keeps its own access permissions list, and that new list becomes what its own descendants inherit. Anyone who is not on the new permissions list can no longer view the folder and everything inside it, even if they can still view the parent folder.
Restoring inheritance sets the folder access permissions back to the parent folder’s permissions list.
Note: Break inheritance only when the audience genuinely differs. Keep in mind that permission changes cascade to all child items, and disabling inheritance creates a standalone access permissions list that must be managed manually.
Access roles
Access roles define what users can do and what actions they are not permitted to perform. These include things like creating folders and sub-folders, managing settings, creating, editing, and viewing drafts and processes. Roles can be combined, allowing a user to be both a folder Owner and a Platform Admin.
|
Role |
Scope |
Can do |
Can't do |
|---|---|---|---|
| Platform Admin | Whole workspace |
|
|
| Owner | Owned folders and descendants |
|
|
| Designer | Assigned folders, plus drafts they create or collaborate on that are not in folders |
|
|
| Contributor | Assigned folders |
|
|
| Viewer | Assigned folders | Read published processes only. | See drafts, draft badges, draft rows, draft search results, or any create, edit, publish, archive or permission controls. |
Role considerations:
-
A Designer can start an unfiled process, meaning a process that is not stored in a folder. A Contributor can only start processes from folders to which they have been granted access. Conversely, a Contributor can archive items within their assigned folders, while a Designer cannot archive items in any folder.
-
A folder Owner can archive items but cannot restore or permanently delete them. Recovery actions are intentionally restricted to the workspace level. See Archive processes for more information.
-
To be assigned a process role (Process Owner or Process Expert) the user must first be assigned an access role.
Permission matrix
|
Visibility |
Platform Admin |
Owner |
Designer |
Contributor | Viewer |
|---|---|---|---|---|---|
| See the folder hierarchy | All folders | Only as assigned | Only as assigned | ||
| View published process | ✔ | ✔ | ✔ | ✔ | ✔ |
| View drafts in a folder | ✔ | ✔ | ✔ | ✔ | ✘ |
| View unfiled drafts | ✔ | ✘ | Own only * | ✘ | ✘ |
| See draft indicators, rows, and search results | ✔ | ✔ | Only as assigned | Only as assigned | ✘ |
* Visible only where the user is the creator or a named collaborator on that draft.
A process has different access permissions at each state. An unfiled draft process (one that is not in a folder) has no folder permissions and is only visible to the process creator and to the participants. Once a draft is filed, the folder permissions are applied.
|
Role |
Unfiled draft process |
Draft process filed in a folder |
Published process |
|---|---|---|---|
| Platform Admin | Can see and edit. | Can see and edit. |
Can only see. An edit creates a draft. |
| Folder Owner | Only if assigned to the draft or process. | See and edit in owned scope. |
Can only see. An edit creates a draft. |
| Designer | Only if creator or named collaborator. | See and edit in owned scope. |
Can only see. An edit creates a draft. |
| Contributor | Cannot see. | See and edit in owned scope. |
Can only see. An edit creates a draft. Publish and archive allowed in assigned scope. |
| Viewer | Cannot see. | Cannot see. | Can only see. Cannot edit and start a draft. |
Note: A published version of the process can only ever be viewed, never edited. Users with edit permissions can modify the process, but their changes are saved as a new draft version until they are published.
Process Viewers can never see draft versions of a process. This restriction goes beyond simply hiding actions. Viewers do not see draft cards, draft rows, draft badges, draft search results, or any controls for creating, editing, publishing, archiving, or managing permissions. For example, if a folder contains one published process and three draft processes, a Viewer sees only the published process.
Permission status indicates the progress of Nintex Processes as it applies or updates access permissions for a folder, draft, or process after the item is created, moved, modified, or deleted.
Permissions decide who can see or change an item. When you create, move, or change a folder, draft, or process, Nintex Processes accepts your request and applies the permissions in the background. The control you used shows a busy indicator while the permissions are being applied. You then see a confirmation, or a message with a Retry option if the permissions could not be applied.
Nintex Processes does not show a separate permission status label or column. The status appears only as the busy indicator, the confirmation, or the error message on the action you just performed.
What happens to your item
-
While permissions are being applied: the button you clicked shows a busy indicator. Keep the dialog or panel open until the indicator stops.
-
When permissions are ready: a confirmation message appears, and the dialog or panel closes or the next page opens.
-
If permissions cannot be applied: An error message appears, and the button changes to Retry. Nintex Processes does not create or update items that users cannot access. If the operation involves creating a new folder, creating a new draft, or publishing a process for the first time, the item is removed. If the operation involves updating an existing item, the change is not applied, and the item retains its previous permissions or location.
-
If you delete an item: the item is removed. Nintex Processes then clears its permissions in the background and does not show you progress or the outcome.
-
If you delete an item: The item is removed immediately. Nintex Processes then removes its associated permissions in the background. This cleanup process occurs automatically, and no progress or status information is displayed.
If no response is received within approximately 35 seconds, the action is considered to have failed, and the same error message is displayed.
If an action keeps failing, wait a few minutes and try again. If it still fails, contact your Nintex administrator or support. Include the action you took, the name of the folder, draft, or process, the time, and the exact message that appeared.
Systems Permissions
The systems page permissions control who can create, edit, and delete the systems in your Nintex Processes catalog.
A system is an application or tool that your processes use, such as a CRM or an HR tool. You manage the catalog of systems on the Systems page, and you can then assign those systems to activities in a process. Everyone can see the catalog, but only people with the right role can change it. This keeps the list accurate and prevents accidental changes.
Nintex Processes only shows the buttons and menu options that you are allowed to use. If you cannot create, edit, or delete systems, those options do not appear.
|
Role |
View systems |
Create |
Edit |
Delete |
|---|---|---|---|---|
| Global Admin or Automation Admin | ✔ | ✔ |
✔ |
✔ |
| Designer | ✔ | ✘ |
✔ |
✘ |
| Participant | ✔ | ✘ |
✘ |
✘ |
-
In the left navigation, under Connection, click Systems.
-
Review the System, Description, and Associated Processes columns. Use the Search box to find a system by name.
-
Click the number of processes in the Associated Processes column to see which processes use the system. If you do not have access to a process, it appears as Restricted access.
Note: When you assign a system to an activity in a process, the list shows the full catalog of systems regardless of your role.
Only Admins see the Create button.
-
On the Systems page, click Create. If no systems exist yet, click Create system instead.
-
In the Create system dialog, specify a Name of up to 150 characters. The name is required and must be different from the name of every other system.
-
Optional: Specify a Description of up to 1,000 characters.
-
Click Add.
-
On the Systems page, find the system and click its System actions menu.
-
Select Edit. If the menu has no Edit option, you cannot edit that system.
-
In the Edit system dialog, change the Name or Description.
-
Click Save.
Deleting a system cannot be undone.
-
On the Systems page, find the system and click its System actions menu.
-
Select Delete. If the menu has no Delete option, you cannot delete that system.
-
In the Delete dialog, read the message, and then click Delete.
Note: The Nintex CE Platform system is reserved and cannot be deleted, even if you are allowed to delete other systems.
Considerations
-
The last folder Owner cannot be removed or demoted. Every folder keeps at least one owner, and the action is blocked for every role.
-
Published content is never edited directly. Edit permissions grant the right to create or open a draft.
-
A process cannot be published before it is filed into a folder.
-
Drafts do not exist for Viewers.
-
Process-level roles, such as Process Owner A process role. A Process Owner in Nintex Processes is responsible for managing the lifecycle of the process. and Process Expert A process role. A Process Expert in Nintex Processes is responsible for keeping the process definition updated to match how the organization actually functions., can only be assigned to users who already have access to the process. Users who do not have the required visibility and edit permissions cannot be selected and do not appear in the people picker.
-
Access is granted from the top down. A user must first be eligible at a parent level before they can be assigned access to any sub-folder or process beneath it.
-
When inheritance is broken, the new permissions apply to the folder and everything beneath it. Users who are not included lose visibility of both the folder and its processes.