Users, Groups & Permissions Overview

The platform uses three-tier model to control access:

Users  →  Groups  →  Permissions

• Users are individual accounts — your content authors, reviewers, administrators, and students. Users can be part of a Group.
• Groups are named collections of users. Instead of configuring access for each user individually, you configure it once on the group and all members inherit it.
• Permissions are rules that define what actions a group is allowed or denied on specific resources or services.

# How Permissions Work

Permissions are based on rules. Each rule describes which action can be taken on what resources by whom? More details here:

Part	What it means
Permission	Either Allow or Deny
Action	The operation being allowed or denied (e.g., create, edit, delete, view, etc.)
Resource	The specific resource type being controlled (e.g., question-bank, question-paper, tags)
Service	Which part of the platform (e.g., the testmaker or core service) the rule applies to

If no explicit rule exists, access is controlled by default permissions defined by system.

Tip: To match "any" resource/action, you can use wildcard *. For resource * means "any resource", and * for action means "any action". We can also say QUESTIONS.* means all actions related to questions. An example: single rule with resource=*, action=QUESTIONS.*, and permission=Allow grants full access to all question operations.

---

# Default Setup

3 Groups Admin, Content writer and Student comes with your account. It has following permissions by default:

# Admin Permissions

Service	Resource	Action	Permission	Effect
CoreService	*	GROUPS.*	ALLOW	Allows any action on any group
CoreService	*	PERMISSIONS.*	ALLOW	Allows to change permissions
CoreService	*	USERS.*	ALLOW	Allows any action on any user
TestMaker	*	*	ALLOW	Allows any action on any resource (Tags, Tag Groups, Tag Hierarchies, Questions, Question Papers)

# Content writer Permissions

Service	Resource	Action	Permission	Effect
CoreService	*	*	DENY	Deny any action, unless explicitly allowed.
CoreService	*	USERS.VIEW	ALLOW	Allows to view users
TestMaker	*	*	DENY	Deny any action, unless explicitly allowed.
TestMaker	*	TAG_GROUP.VIEW	ALLOW	Allows viewing Tag Groups
TestMaker	*	TAG.VIEW	ALLOW	Allows viewing Tags
TestMaker	*	TAG_HIERARCHY.VIEW	ALLOW	Allows viewing Tag hierarchies
TestMaker	*	COURSE.VIEW	ALLOW	Allows viewing Courses
TestMaker	*	QUESTIONS.*	ALLOW	Allows any action on Questions
TestMaker	*	QUESTION_PAPERS.*	ALLOW	Allows any action on Question Papers

# Student Permissions

Service	Resource	Action	Permission	Effect
CoreService	*	*	DENY	Deny any action, unless explicitly allowed.
TestMaker	*	*	DENY	Deny any action, unless explicitly allowed.
TestMaker	*	TAG_GROUP.VIEW	ALLOW	Allows viewing Tag Groups
TestMaker	*	TAG.VIEW	ALLOW	Allows viewing Tags
TestMaker	*	TAG_HIERARCHY.VIEW	ALLOW	Allows viewing Tag hierarchies
TestMaker	*	COURSE.VIEW	ALLOW	Allows viewing Courses
TestMaker	*	QUESTIONS.VIEW	ALLOW	Allows viewing Questions
TestMaker	*	QUESTION_PAPERS.VIEW	ALLOW	Allows viewing Question Papers
TestMaker	*	QUESTIONS_PAPERS.ATTEMPT	ALLOW	Allows attempting Question Papers

You can change these permissions anytime. But it is recommended that if you wish to have some other roles, please create a new group and assign the permissions over there.

# Default workflow to setup users, groups and permissions

1. Create Groups — Ideally default roles are good, but you can define roles of your choice (e.g., Content Authors, Reviewers, Administrators). For better management of students, create one group for each course.
2. Create Users — add user accounts and assign them to them Student and their course group.
3. Assign Courses to Groups — If your courses are not already created, create them. Then assign course to their groups.
4. Assign Permissions to Groups — If you are creating new Groups (except groups for courses), configure what each group can do.

# Getting Started

1. Managing Groups — Create groups, assign courses and permissions to groups

2. Managing Users — Create, edit, block/unblock, and remove user accounts, assign users to groups

3. Managing Permissions — Add, edit, and remove permission rules for groups