Permissions

A permission is the authorization given to users that enables them to view a type of information or to perform an action in Mambu. You can either assign individual permissions to users or you can group permissions by creating a role and then assigning that role to a user.

By managing permissions, each user will only have access to the information that is relevant for their required activities in Mambu.

For more information about assigning permissions to either users or roles see Creating a User or Roles.

Granular Administration Permissions

In Mambu, a user with the type administrator has access to the Mambu Administration section. This user type has complete control over the Mambu app and can do all possible actions. However, you will often need to create multiple types of administrators, that have their access limited to some areas of the Mambu Administration section.

For example, you might want to create Roles similar to these, for more granularity:

• A Financial Administrator, in charge with setting the rates, currencies, and so on.
• An Access Administrator, who manages users, roles, access preferences, and who can set up Federated Authentication.
• A Technical Setup Administrator, who manages the setup of Event Streaming APIs, Data Imports and Exports, and so on.

In order to enable you to create separate roles for the needs of your organization, our Administration permissions provide a high level of granularity. With granular permissions, you can create robust role-based access control rules and apply the principle of least privilege for your users, only giving permissions as absolutely needed for completing specific tasks.

Standard Behavior for Granular Administrator Permissions

The standard behaviour for granular permissions on the Administration section, applicable both on the UI and on the API endpoints is the following:

• Create, Read, Update, Delete (CRUD) permissions on more complex entities.
• Manage permission on simpler entities.

To better understand how the CRUD permissions and the Manage permission standard is applied, let's pick the Branches entity and go through each permission.

Create Entities

The Create permission has implicit View permission mapped. This means that a user with the Create permission also has all the capabilities a user with only View permission has. Please note, this is an implicit View permission, which means it is not signaled in the Permission Tree of the given entity.
This permission also gives you the capability to create a new entity of the given kind, both via the UI and API, provided that you also have API access.

View Entity Details

This permission is applicable to API 2.0 endpoints such as getAll and getById provided that you also have API access. For branches, these would be the following:
GET /branches
GET /branches/{branchID}

This permission is applicable on Mambu UI as follows:
You can see all branches by navigating to Administration > Organization > Branches. You can't edit any fields or create a new branch if you only have View permissions.
You can click on branch and/or ID as applicable, in order to see the details.

Edit Entities

The Edit permission has implicit View permission mapped. This means that a user with the Edit permission also has all the capabilities a user with only the View permission has. Please note, this is an implicit View permission, which means it is not signaled in the permission tree of the given entity.
This permission also gives you the capability to Edit an entity of the given kind, both via the UI and API, provided you also have API access.
Edit entity permissions contains access to actions like:

• Activate/Deactivate Entity
• Unlock Entity (applicable for Users)

Delete Entities

This permission has an implicit View permission. This means that with the Delete permission, you also have all the capabilities a user with only View permission has. Please note, this is an implicit View permission, which means it is not signaled in the permission tree of the given entity.
The delete user action is available both for Administrator and other users that will be granted the “Delete Users” permission.

Manage Entity

The Manage entity permission is used with smaller entities that do not need a full CRUD operation set or to cover current lack on granularity with a minimum impact on backwards compatibility.
This permission gives you access to fully manage the entity or feature, while enhancing granularity by not needing an Administrator user type to edit, delete or create new entities.

Permission descriptions

A list of permissions is available in the Mambu UI when you go to create or edit any users or roles.

The list of available permissions visible under the Permissions section in the relevant dialogs, changes depending on whether you have Mambu and/or API options selected under Access Rights.

Below you can find a description of each of the permissions available in Mambu by category or set. These permissions function identically for Mambu user accounts and Mambu roles. Each permission includes the name used in the UI and the name used with the API (in parentheses).

Particular actions that depend on permission combinations

There are certain actions that a user can perform in Mambu without having a specific permission in place for them, they depend upon other permissions or user types.

• Only administrators can create Views which are available for other users.
• Users can change their own password but only administrators can change other users' passwords.
• Only the user who created a task can edit it.
• In order to view loan and deposit accounts you will need the view client permission in addition to view permissions for the type of account you want to view.
• To carry out transfer transactions, users need to also have the “Enter Repayments” or “Make Deposit” permission (if the transfer is meant to become a repayment in a loan account or a deposit in a savings account).
• For rescheduling loans, users also need the “Create Loan” permission.
• To revert a certain type of transaction, besides the "Apply Loan/Deposit product adjustments", the user requires the permission to post that type of transaction. For example, to revert a repayment, the user must have the "Enter Repayments" permission as well.
• To change the Loan's Account branch, you need the "Manage Loan Association" permission, which is disabled by default. Without this permission, the branch box from the Create Loan Account form and the Edit Loan Account form will be read-only and you won’t be able to change the branch.