Planning RBAC Infrastructure

RBAC (role-based access control) limits what end-users can see or do based on their assigned role. When planning an RBAC infrastructure, thorough testing is essential to confirm the configuration works correctly before deployment. Begin by listing all end-users, then map out which submissions each account requires.

Creating Test Accounts

As a best practice, use two accounts for every role and group. That way, each role and group can be tested twice to confirm the RBAC is correct. For this example, two agencies exist: Agency 1 and Agency 2. Each agency requires City Admin, Agency Admin, Program Manager, and Client roles. For testing purposes, create two accounts of each role for each agency. For example, Agency Admin 1A and Agency Admin 1B for Agency 1. Then, Agency Admin 2A and Agency Admin 2B for Agency 2.

To test the RBAC infrastructure, create unique logins for each account. As a best practice, use variations of the same email address for ease of testing. Begin with the email address, then add a + followed by a unique string between the username and the @ sign. This string should clearly represent the account. For example, the email address for the City Admin A account can be your_email+caa@unqork.com.

The following table shows an example email address for each account:

Mapping Submission Access

Next, determine which submissions each role should be able to access. Map this out before configuring RBAC; use a spreadsheet, planning document, or any format that works for the team.

The example below shows the completed access map for this infrastructure. Use ✓ to indicate access and leave cells blank for no access. Adapt this structure to match your own role hierarchy and submission types.

Creating Groups and Assigning Roles

Lastly, create groups and decide which roles should belong to each one. Include only roles that need access to specific submissions in each group. For this example, the groups are dept-labor-admin, agency-1, agency-2, program-1, and program-2.

The following table shows the role, group, and email assignments for this example:

Add a password column to manage temporary passwords for each account.

Test RBAC before building the full application. Using a simple test application, like the form and dashboard from this example, is an effective way to verify the configuration. Most of the work involves defining clear expectations and generating sample data for testing. This lets Creators confirm that roles and groups are configured correctly before building out the rest of the application.