Nest groups, scope access with filters, and combine every access layer at once.
This builds on Users and Access Rights, which covers Users, User Groups, and Roles. Here we cover the advanced options: nesting groups, filtering access down to individual records, and how everything combines.
Nested Subgroups #
A User Group’s Subgroups field lets you nest other existing groups inside it, so you can build access in layers instead of one flat list.
- Open Settings, User Management, Groups.
- Click Add New Group, or open an existing one to edit it.
- In Subgroups, select one or more groups to nest inside this one.
- Click Save.
⚠️ Needs verification
Whether nesting a group extends the parent’s roles and workspaces down to the subgroup’s members, or works the other way around, isn’t confirmed yet.
Field-Level Access Filters (Optional Settings) #
Optional Settings narrows what a user or group can see within an object type, using a predicate — an expression that’s true or false for each record. Only records where it’s true stay visible. It’s available on both the Edit User panel and the Add/Edit Group panel.
Use a filter to go further than a role and workspace alone allow — for example, limiting a Reader role to business partners in one region only.
- Open Optional Settings on the Edit User or Add/Edit Group panel and click Add Filter.
- Name the filter and choose a Permission Object: Business Partners, Projects, Items, or Workspaces.
- Write the Predicate and click Validate.
- Click Add, then Save.
ℹ️ Good to know
For Workspaces, you can target a specific workspace or use the special value general to cover anything not otherwise targeted. Exact matches are checked before general ones.
Predicate Syntax #
Predicates reach into an object’s fields with dot notation, like document.header.documentTypeId, and index arrays with brackets, like document.auditLog[0].time. A caret counts from the end — [^1] is the last item — and a range like [2..] or [..^2] selects a slice.
| Operator | Meaning |
|---|---|
. | Path delimiter, or a decimal point |
() | Groups an expression, or holds function arguments |
[] | Accesses an array item |
{} | Defines an array |
++, -- | Increment or decrement |
! | Logical negation |
+ | Addition or string concatenation |
- | Subtraction, or a negative value |
?: | Ternary if-then-else |
, | Argument separator |
⚠️ Needs verification
The in-app Help lists this reference as incomplete — a dictionary-style key lookup, a null-safe traversal operator, and a way to hide a filter from the document’s other side are all listed as not yet available.
Combining Workspaces, Groups & Roles #
A role sets what a user can do, a workspace sets which documents they see, and a User Group bundles both across many users at once. A predicate filter adds a fourth layer on top, narrowing things down to specific records.
Put them together for scenarios none of them can express alone — for example, a subgroup with a Reader role, scoped to one workspace, further limited by a predicate to business partners in one region.
⚠️ Needs verification
The Partners field on the Add/Edit Group panel appears disabled by default, and what enables it isn’t confirmed yet.
Default Groups on a New Account #
Every new account starts with a set of default User Groups already in place, which an administrator can edit or delete.
⚠️ Needs verification
Which groups and roles ship as the platform default isn’t confirmed yet — what you see in Settings, User Management, Groups may just reflect this account’s own setup.