Users, roles and access
Explain why someone can't see something, and know exactly where to fix it.
A Role isn't a label — it's a full permission matrix, and that matrix is what you actually edit to fix someone's access.
Settings → User Management has three tabs: User list, Groups, Audit log.
The User list carries First Name, Last Name, Email, Role, Last Login, Mandatory 2FA, Mandatory SSO, Onboarding Email (checkboxes), Reset 2FA, and an Actions menu (Edit, Dashboard access, Delete). Five Role values appeared in the User list itself: Customized, C-Level, Administrator, Employee, and Investor — a fifth role beyond the four the curriculum named. A sixth, IT Admin, doesn't appear as a current value in the User list but shows up in the Audit log's own role-change history — worth confirming directly before teaching it as a standing option. Create User, Download user list and Upload user list sit above the table. Above that again: Single Sign-On (enforced per email domain pattern, or optional for all) and a 2FA Organization Policy (mandatory or optional for all).
The Groups tab is where a Role actually becomes concrete: pick one (e.g. C-Level) and it opens a full permission matrix, section by section — Dashboard permissions (My Dashboard, Strategic/Operational/Financial Reporting, Operational/Financial Planning, Forecasting, Access deep drills), Investor reporting permissions (Read/Write), OKR permissions (Read/Write × Employee/Team/Corporate OKRs), Data management permissions (Excel Upload Download, Manage Data Integrations), KPI value permissions (Read/Write × Basic/Confidential/Strictly confidential — this is the other side of 13.2's Confidentiality setting), Query Builder Permissions (Can Build KPIs), Liquidity Planning Permissions, and Digital Twin Permissions (Access driver tree). A footnote on the page explains a starred item: "Automatically included with higher level permission." This is the real answer to "why can't they see that" — not the Role name, but which cells are checked in this matrix for that Role.
The group dropdown isn't limited to the five standard Roles either — a custom group name like "Delegate" can sit alongside C-Level, Administrator, Employee and the rest, each with its own independently-editable matrix, via the pencil icon next to the dropdown.
The Audit log is a plain, readable record of exactly this kind of change: real entries include "User 'felix.engel@valueworks.ai' role changed from 'Administrator' to 'C-Level' by 'admin@valueworks.ai'" and "Dashboard access for 33 dashboard(s) was changed for 'felix.engel@valueworks.ai' by 'admin@valueworks.ai.'" — Action, Timestamp, Executed by, and a Details column that names exactly what changed.
Takeaways
Five roles appear in the User list: Customized, C-Level, Administrator, Employee, Investor. A sixth, IT Admin, turns up in the Audit log's history but not as a current User list value — worth confirming before teaching it as standing.
A Role is a full permission matrix under the Groups tab — Dashboard, Investor reporting, OKR, Data management, KPI value, Query Builder, Liquidity Planning, and Digital Twin permissions, each its own section.
To fix "why can't they see that": open Groups, find their Role, and check the specific permission cell — not just the Role name.
The Audit log records every role and permission change, in plain readable sentences.
Surfaces covered
- User Management → User list
- Groups
- Audit log
- Create User
- Download / Upload user list
- Role (Customized, C-Level, Administrator, Employee)
- Onboarding Email
- Single Sign-On (email pattern, Enforce / Optional)
- 2FA Organization Policy
- Reset 2FA
Also taught in the Academy
Module 13 · Settings and KPI Management
Take it as lesson 13.3 in Business Analyst & FP&A