Elevated privilege roles

Elevated privilege roles require a user to manually accept the responsibility of using the role before the user can access the features of the role.

By default, users do not have elevated privilege roles upon login. They must manually elevate to the privilege of the role. An elevated privilege role only lasts for the duration of the user session. Session timeout or logout removes the role.

You can designate any role as an elevated privilege role, and then assign that role to one or more users. Do this when you want to restrict users from having access to the rights that the role provides right away after login. You can designate the privilege role on the Role form. See Create a role for instructions.
Note: The use of elevated privilege on the admin role is not supported, and may cause unexpected behavior. To require administrators to manually elevate, see Force administrators to manually elevate.
To use an elevated role, all these conditions must be met:
  • The role must be assigned to the user.
  • The user must manually elevate roles.
To grant the admin role to a user, the granting user must also have the admin role. For example, a user with only the user_admin role cannot grant the admin role to other users.* Non-admin users cannot add a user to a group that contains the admin role.* To grant the security_admin role to a user, the granting user must also have the admin role and must elevate to the security_admin role before granting the security_admin role to other users. A user with only the admin role cannot grant the security_admin role to other users.* A user without the security_admin role cannot add a user to a group that contains the security_admin role.

The security_admin role

In the base system, the security_admin role is the only role that has elevated privileges. This role is automatically assigned to the user who is the default System Administrator (admin) user. It provides access to ACLs and High Security Settings.

Figure 1. Roles assigned to the System Administrator (admin) user
The list of roles assigned to the System Administrator (admin) user.
Note: To see this role, you must actually elevate to the security_admin role first. If you are logged in as the System Administrator (admin) user only, you cannot see the security_admin record in the list of roles.
Figure 2. The security_admin role record
The security_admin role record