ExplanationAdminBusiness

How a right takes effect: plan, switch, right

WhereWorkspace settings › Roles & rights › Role › RightsRightsettings.roles

In shortA tick in the role editor is a permission, not a guarantee. Whether a person can actually do something is decided by three gates in order: the workspace's plan, the switch of the app in question, and only then the right. On top of that, some rights need something in the data, such as a reporting line or a team membership. This page explains the gates, the locks in the editor and how to find out why a right does nothing for someone. The individual rights follow on the eight pages after this one.

Three gates before every feature

Skillties checks the same order for every feature:

  1. The plan. Does the feature exist in this workspace at all? Without a contract, only General and Users can be used; every other area is visible but locked. Roles themselves only exist with a contract. In a workspace without a contract an admin holds every right, yet every change to roles is refused.
  2. The app switch. Teams, Feedback, Skills Hub, codetermination and inheritance each have a switch in the settings. If it is off, the surface does not exist and every right on it leads nowhere. Teams, Feedback and codetermination are off in new workspaces; the Skills Hub is on.
  3. The right. Only now does the tick in the role count.

For some rights a fourth condition sits in the data: the reaches “Direct reports” and “Their area” need a reporting line under Organisation. The rights for people in teams need a running team membership. The account rights only apply in the domain workspace. Without that condition the tick is set and still has no effect.

Paul Weber's sidebar: People and Teams from the Member role, Works council from his seat on the body, but no Skills Hub.
Paul Weber's sidebar: People and Teams from the Member role, Works council from his seat on the body, but no Skills Hub.
The same sidebar for Robert Lang as admin: the Skills Hub is added because plan, switch and right come together.
The same sidebar for Robert Lang as admin: the Skills Hub is added because plan, switch and right come together.

What someone sees when a gate is closed differs:

Closed gateWhat the person sees
Planthe settings area locked with a notice; apps as a preview with made-up data
App switchno menu entry; whoever knows the address reads “Teams are switched off” or “Skills Hub is disabled”
Rightno menu entry; a direct call shows “You do not have access”
Datathe surface, but empty or only with themselves

Rights add up, never subtract

What a person may do is the sum of Member, for admins Workspace admin, every directly assigned role, the roles of every group they are in, and for members of the body the Works council role. There are no denials: no role can take away what another allows. If you want to take something from a person, you have to remove it from every role they hold, or take them out of the group.

For rights with a reach, the widest level wins. If Max holds “See the skills of everyone in their area” from Head of department and “See the skills of everyone in the workspace” from Member, he sees everyone. Anyone who wants to limit managers to their own area must first untick it on Member.

The locks in the editor

A locked tick always carries a reason. These are the reasons:

Note at the tickMeaning
“You do not hold this right”You can only grant rights you hold yourself. Whatever you lack is locked for you.
“admin role, fixed”The rights of Workspace admin are fixed and cannot be changed.
“Not available to the review role”The Works council role is maintained under Codetermination, not here.
“Only in a domain workspace”The account rights only apply in a domain workspace. In a manual workspace the ticks do nothing.
no note, with a request statusA request for this right is with the body. The tick is locked until the decision.
Ben Carter holds “Roles & rights” but neither the Skills Hub nor the narrower reaches. In the editor those levels are locked for him; the Hub reads “You do not hold this right”.
Ben Carter holds “Roles & rights” but neither the Skills Hub nor the narrower reaches. In the editor those levels are locked for him; the Hub reads “You do not hold this right”.

The same rule applies when granting: whoever attaches a role to a group must hold every right of that role. Whoever staffs a group that carries rights must hold those rights, otherwise the group shows “You lack rights”.

Without the right: the area is missing

An administration right opens exactly one area of the settings window. Whoever does not hold it does not see the area, not even for reading. Julia from People development therefore finds only the areas whose right her role carries: Users, Groups, Organisation, People and Feedback. She can still look up which rights a role carries, namely under Check and in the user list, where every role of a person appears as a badge.

Julia Hart's settings window: only the areas whose right the People development template carries. Roles & rights is missing.
Julia Hart's settings window: only the areas whose right the People development template carries. Roles & rights is missing.

Rights with a dot: codetermination

With codetermination switched on, every right that needs approval carries a dot in the editor. Ticking it does not set a tick right away but files a request with a reason; the button then reads Submit for approval. Removing a right applies immediately. Which rights this covers is set by the workspace under Codetermination. The preselection holds the six sight rights on skills and mapping, the right for Roles & rights, the right for the codetermination settings and the three rights of the body. The help says for every right whether it is part of that preselection or only recommended.

Finding out why a right does nothing

When someone says “I can't see the Skills Hub”, walk through the gates in order:

  1. Under Roles & rights › Check, choose the person. Is “Use the Skills Hub” in the list? If not, the right is missing, and next to it you see which roles the person has at all.
  2. If it is there, check the switch: Skills Hub in the settings must be on.
  3. Check the plan: if the area in the settings is locked, the contract is missing.
  4. Check the data: the Hub additionally needs “Open People”; reaches need the reporting line; teams need a membership.
“Check” for Ben Carter: the rights from “IT administration” have no group behind them, because the role is assigned directly.
“Check” for Ben Carter: the rights from “IT administration” have no group behind them, because the role is assigned directly.

Example

At Nordwind, Ben Carter from IT is to maintain roles, members, groups and the Entra connection, but see no more about colleagues than every member does. Robert creates the role “IT administration” with the four administration rights and assigns it to Ben directly. Ben can now edit roles, but only with the rights he holds himself: if he wants to give a new role “Use the Skills Hub”, the tick is locked for him, “You do not hold this right”. When Clara Bell asks why she, as head of sales, cannot see the levels of her area, Ben looks under Check: Clara holds “See the mapping of everyone in their area” from Head of department, but under Organisation nobody reports to her. The right is there, the reporting line is missing. Ben does not hold Organisation, so he asks Julia to assign the sales people to Clara.

Checked with version 0.6.0 · 21 Oct 2026