Security

A role assignment is a way to grant to a user and/or a security group permission to access any individual work item in the work item heirarchy, including all of its associated data and any of a child work item.

Unless you want a user and/or security group to be granted access to every work item in the work item heirarchy, you should not make role assignments to the enterprise portfolio.
Users and/or security groups will inherit the greatest level of permission granted to any particular work item. For example, if a security group is assigned to more than one security role and either of those security roles are given a role assignment to a work item, any user who belongs to the security group with the role assignment will have permission to access that work item and any of its associated data or child work item.
If you do not want a user and/or a security group to have permission to edit information in a child work item, you can delete or clear the role assignment for the specific child invesment; however, users and/or security groups will always be able to view data in a child work item if they have permission to view its parent.
It is better to create role assignments by using security groups rather than for individual users. This will simplify the process of tracking and managing role assignments made to users across your organization.

The security for any work item is defined using the Role Assignments tab in the Properties dialog box. The Role Assignments tab has two views:

Simple The simple view shows you which users and/or security groups have a role assignment based on a security role and which users and/or security groups inherit permissions from a parent work item. The simple view does not show you which permissions have been inherited or which users and/or security groups have an inherited role assignment based on a security role assigned to a parent work item.
Advanced The advanced view shows you which users and/or security groups have a role assignment based on a security role, which users and/or security groups inherit permissions from a parent work item, which permissions have been inherited, and which users and/or security groups have an inherited role assignment based on a security role assigned to a parent work item.

Tab: Role Assignments, Advanced

The Role Assignments, Advanced tab in the Properties dialog box is used to advanced role assignment details.

The following fields are available from the Role Assignments, Advanced tab in the Properties dialog box:

Fields	Description
Add	Click this button to add a selected user and/or security group to the role assignment for this work item. This will add the Is Assigned To Role icon in the Assignment column.
Assignments	This column indicates whether a user and/or security group has a role assignment to the selected work item. If the column shows Is Assigned To Role, the user and/or security group has been given a role assignment to the selected work item. If the column shows Inherits Assignment To Role, the user and/or security group is inheriting its role assignment from a role assignment made to a parent work item. If the column shows Does Not Inherit Assignment To Role, the user and/or security group is not inheriting its role assignment from a parent work item.
Clear	Click to clear a selected user and/or security group from the role assignment for this work item. This will remove the Is Assigned To Role or Does Not Inherit Assignment To Role icons from the Assignment column.
Group / User	Displays the users and/or security groups that are available for a role assignment to the selected work item. This list displays only security groups by default.
Manage By	Select Role to manage role assignments by security role and Group / User to manage role assignments by user and/or security group.
Parent Groups	This column indicates the security groups to which a user and/or a security group belong. This column is only visible when the Role option is selected for the Manage By selector.
Remove	Click this button to move the selected attributes from the Selected Attributes box to the Available Attributes box.
Role	This column displays the security roles from which users and/or security groups can be given role assignments.
Show Unassigned	Depending on which method you choose to manage role assignments, displays security roles or displays users and/or security groups who do not have a role assignment to the selected work item.
Show Users	Select to display both users and security groups in the Group / User list.
Simple	Click to view the Role Assignments tab, simple view.

Tab: Role Assignments, Simple

The Role Assignments, Simple tab in the Properties dialog box is used to view role assignment details.

The following fields are available from the Role Assignments, Simple tab in the Properties dialog box:

Fields	Description
Add	Click this button to add a selected user and/or security group to the role assignment for this work item. This will add the Is Assigned To Role icon in the Assignment column.
Advanced	Click to view the Role Assignments tab, advanced view.
Assignments	This column indicates whether a user and/or security group has a role assignment to the selected work item. If the column shows Is Assigned To Role, the user and/or security group has been given a role assignment to the selected work item. If the column shows Inherits Assignment To Role, the user and/or security group is inheriting its role assignment from a role assignment made to a parent work item. If the column shows Does Not Inherit Assignment To Role, the user and/or security group is not inheriting its role assignment from a parent work item.
Clear	Click to clear a selected user and/or security group from the role assignment for this work item. This will remove the Is Assigned To Role or Does Not Inherit Assignment To Role icons from the Assignment column.
Group / User	Displays the users and/or security groups that are available for a role assignment to the selected work item. This list displays only security groups by default.
Remove	Click this button to move the selected attributes from the Selected Attributes box to the Available Attributes box.
Role	This column displays the security roles from which users and/or security groups can be given role assignments.
Show Users	Select to display both users and security groups in the Group / User list.