Introduce Granular Dashboard Roles and Permissions

Currently, dashboard access is limited to a small number of high-level roles, with administrators having full access to all functions. This creates a challenge when staff require visibility into dashboard information but should not be granted administrative privileges.

Many institutions have staff members with different responsibilities. For example, some users only need to view reports and statistics, while others may need access to manage resources but not alter system-wide settings. The current permission model does not provide sufficient flexibility to support these use cases.

I would like OpenAthens to introduce additional roles and more granular permissions.

Minimum enhancement:

• Add a Read-Only Dashboard role with view access to all dashboard areas and no editing capabilities.

Preferred enhancement:

• Add two additional roles:

  • Read-Only Dashboard role (view all areas)

  • Statistics Viewer role (view statistics and reports only)

Ideal enhancement: Provide configurable role-based permissions that allow administrators to assign read and/or edit access to specific dashboard sections, such as:

• Accounts (Read Access / Edit Access)

• Resources (Read Access / Edit Access)

• Statistics (Read Access / Edit Access)

• Preferences (Read Access / Edit Access)

• Management (Read Access / Edit Access)

Benefits

• Supports the principle of least privilege.

• Improves governance and security by reducing unnecessary administrative access.

• Minimizes the risk of accidental changes to configurations.

• Enables institutions to provide appropriate access based on staff responsibilities.

• Aligns with the role-based access controls available in many enterprise applications.

This enhancement would make dashboard access management significantly more flexible while maintaining security and operational efficiency.