Assign roles to ensure that users can perform all necessary actions.

Roles and personas

Warning: Giving someone the pa_admin or pa_data_collector role is equivalent to giving them admin, from a security perspective.
RoleAuthorizationsTypical persona
No role
  • View Performance Analytics visuals on the Service Portal.
  • View dashboards that have been shared with this user.

    Some dashboards require a subject matter related role for viewing, such as sn_hr_core_basic for the HR Agent dashboard. Dashboard owners and administrators can also restrict dashboard access by role. For more information, see Dashboard permissions.

Requester who does not need any access to Performance Analytics beyond certain visualizations of results

Any role (not necessarily a Performance Analytics role)
  • Create dashboards.
  • Restrict access by role to a dashboard they create.
  • Share dashboards they own.
pa_viewer

Contained by: All roles except pa_contributor
Before Quebec, this role was necessary for the following actions. It may still be necessary on upgraded instances.
  • View Analytics Hub .
  • Create personal thresholds and targets for indicators.
  • Read, Update, and Delete thresholds and targets that they created.
  • View text analytics widgets on dashboards.
 Requester who needs and understands the details of key performance indicators
sn_pa_diagnostics.pa_diagnostic

Contained by: pa_admin
  • Read from the Diagnostics tables.
  • Activate or deactivate a diagnostic.
  • Run diagnostics.
  • Delete message records and diagnostic logs.
 No specific persona, but this role would typically be assigned to individual business analysts or groups of fulfillers.
pa_contributor

Contained by: pa_power_user, pa_admin

 For indicators for which the user is designated as a Contributor:
  • Read and update scores in scoresheets.
  • View the Analytics Hub.
This user can also read dashboards that have been shared with them.		 No specific persona, but this role would typically be assigned to individual fulfillers or groups, who are allowed to set indicator scores manually
pa_kpi_signal_admin

Contained by: admin

 Enables the user to dismiss a signal or reset the baseline for KPI Signals.

Process owner who also has some training in Performance Analytics. Also needs the pa_viewer role.
pa_target_admin

Contained by: pa_power_user, pa_admin
  • Create targets.
  • Read, update, and delete all targets, including those that they do not own.
  • Assign targets to indicators.

Manager who knows what targets to set but may not have any further input to Performance Analytics
pa_threshold_admin

Contained by: pa_power_user, pa_admin
  • Create global thresholds.
  • Read, update, and delete all thresholds, including those that they do not own.
  • Assign thresholds to indicators.

Manager who knows what thresholds to set but may not have any further input to Performance Analytics
pa_analyst

Contained by: pa_power_user, pa_admin
  • CRUD text analytics keywords, phrases, and stop words
  • Read indicator sources.
 No specific persona, but this role would be assigned to individual fulfillers or groups whose expertise includes keywords, phrases, and stop words for word clouds.
pa_power_user

Contained by: pa_admin

The pa_power_user role contains the pa_viewer, pa_contributor, pa_target_admin, pa_analyst, and pa_threshold_admin roles.
  • CRUD indicators and breakdowns.
  • CRUD widgets
  • Add Performance Analytics widgets to dashboards.
  • CRUD text index configurations for text analytics.
  • CRUD bucket groups.
  • CRUD indicator groups

Business analyst. Understands the business use cases for Performance Analytics and the requirements for indicators and breakdowns.
pa_data_collector

Contained by: pa_admin
  • CRUD, schedule, and run data collection jobs
  • CRUD indicator and breakdown sources
  • Read some system properties
  • CRUD system units
  • CRUD scripts and automated notifications
  • CRUD bucket groups

Technical expert who understands the underlying database record structure of Performance Analytics
pa_admin

The pa_admin role contains the pa_power_user, sn_pa_diagnostics.pa_diagnostic, viz_admin, and pa_data_collector roles.
  • Read Performance Analytics properties.
  • Access Admin Console
  • Launch Dependency Assessment

Performance Analytics technical expert who also understands business needs.
admin The system administrator role. Users with the admin role can perform all pa_admin functions, edit properties, create database views, CRUD any dashboard, and assign ownership to dashboards. System administrator

Spotlight roles

RoleAuthorizationTypical persona
pa_spotlight

Contains: pa_viewer, pa_spotlight_copy_breakdown

 CRUD Spotlight groups and criteria. Expert who understands the business logic of what records require reminders.
pa_spotlight_viewer Access to the dashboards from the Analytics and Reporting Spotlight Solutions. Fulfiller who needs more than simple Priority setting to remind them of records that require action.
pa_spotlight_copy_breakdown Can copy Spotlight groups to multiple elements of a breakdown. Spotlight expert or business analyst who understands the applicability of a Spotlight group by breakdown element.
pa_spotlight_copy_domain Can copy Spotlight groups to multiple domains

Domain administrator with Performance Analytics expertise

Role hierarchy

Certain roles such as pa_power_user and pa_admin include other roles. For example, pa_power_user includes pa_contributor. This diagram shows the role hierarchy.

The pa_admin role hierarchy.

Required roles for actions

ModuleActionMinimal required role
Admin Console Access pa_admin
Analytics Hub (Scorecards) View

None, since Quebec. However, upgraded instances may still require pa_viewer.
Automated indicators CRUD pa_data_collector or pa_power_user
Automation schedules Read and delete (other security restrictions likely apply) pa_data_collector
Automation scripts CRUD pa_data_collector
Breakdowns and elements, including breakdown relations CRUD pa_data_collector or pa_power_user
Bucket groups CRUD pa_data_collector or pa_power_user
Color schemes for charts and targets CRUD pa_power_user
Dashboards (Responsive or Platform Analytics) Create a dashboard. Update a dashboard they created, including restricting access by role. Any roles necessary to access the data to display, or any one role
Responsive dashboards

Add Performance Analytics widgets to responsive dashboards you own.

 pa_power_user
Dashboards (Responsive or Platform Analytics) Read a dashboard that has been shared with you No role by default, but dashboards can require roles to view their data. For more information, see Dashboard permissions.
Dashboards (Responsive or Platform Analytics) Update, delete, or share a dashboard that you own. pa_power_user
Dashboards (Responsive or Platform Analytics) Update, delete, or share any dashboard. Reassign ownership of any dashboard. admin (and dashboard role dashboard_admin)
Data collector jobs Read, write, execute pa_data_collector
Dependency assessment Launch dependency assessment from indicator or breakdown form pa_admin
External indicators and breakdowns CRUD pa_data_collector or pa_power_user
Formula and manual indicators CRUD pa_power_user
Indicator Groups CRUD pa_power_user
Sources, either indicator or breakdown CRUD pa_data_collector
Indicator targets Read and edit targets that you do not own pa_target_administrator
Indicator targets or thresholds Create new. Read or edit ones you own.

None, since Quebec. However, upgraded instances may still require pa_viewer.
Indicator thresholds Read and edit thresholds that you do not own pa_threshold_administrator
In-form analytics CRUD pa_power_user
KPI Signals Reset baseline or dismiss signal pa_kpi_signal_admin
Lists in all applications Access an interactive analysis No role by default, but some interactive analyses require roles to view their tables
Manage diagnostics Read, execute, delete sn_pa_diagnostics.pa_diagnostic
Scheduled email summary jobs CRUD pa_power_user
Scoresheets CRUD pa_power_user
Service Portal View Performance Analytics visuals No role
System Properties Edit admin
System Properties Read pa_data_collector for some, pa_admin for all
System Units CRUD pa_data_collector
Text Analytics Set up text index configurations pa_power_user
Text Analytics View a text widget on a dashboard

None, since Quebec. However, upgraded instances may still require pa_viewer.
Text analytics keywords, phrases, or stop words CRUD pa_analyst
What's on the Move News Rules and Statistics Generators Read, edit pa_power_user
Core UI Performance Analytics Widgets CRUD pa_power_user