Tachyon roles

There are two types of Tachyon roles that can be applied to the Tachyon users, system roles and custom roles.

System roles

System roles are built-in and are not configurable, however they can be assigned to users the same as any other role. The following table lists the built-in system roles.

Questions, responses, actions are examples of securables. Other Consumers may create their own system roles and securables.

Custom roles

Custom roles can be edited, allowing you to add or remove permissions if you require. used to define who is able to use specific Instruction Sets to ask questions, run actions or approve actions. For more information please refer to the Defining custom Tachyon roles heading on this page.

The following table lists built-in custom roles used by Tachyon Applications.

Considerations when using the Full Administrator role

The Full Administrator role can be used to provide across the board permissions to a user. While this may be convenient in certain circumstances, you should be aware that this is a powerful role and should be used with appropriate caution.

Using Full Administrator in a lab environment

To get things up and running quickly in a lab environment, you may want to make use of the full administrator role. This will help minimize the number of users required for an evaluation and reduce the initial configuration required.

To further minimize the number of users needed, you can also enable the Windows account used to install Tachyon to assume the Tachyon full administrator role. The installation account is added as the system principal user in Tachyon by the installer, and its Tachyon permissions are locked down by default. You can allow it to assume the full administrator role using the following steps:

1. Create a Tachyon user from an existing AD security group.
2. Apply the Tachyon full administrator role to the user.
3. Add the installation account to the AD security group.

In the short term it's fine to make use of full administrators in this way, but this practice is not really suitable for large-scale deployments and should be used with care for the following reasons:

• The full administrator role has permissions to do everything in Tachyon. It has across the board permissions to all Instruction Sets and therefore can be used to run actions that can have a major impact on your network.
• The full administrator accounts receive emails for all the transactions that are performed by Tachyon.

Different approaches for defining permissions

Tachyon provides a flexible system for defining permissions for the Tachyon features. There are a number of different ways of approaching the task, here we outline the general choices that can be made for assigning Tachyon users to system and custom roles.

Managing access primarily using the Tachyon Permissions console

In this approach, Tachyon users are added individually using their Active Directory credentials. This approach is more secure than alternatives because all users, roles and access rights are managed only through the Tachyon Permissions console.

Managing access using Active Directory

Using this approach, Tachyon users are added as Active Directory security groups. Tachyon roles are then associated with those groups, and management of the individual users who can access Tachyon is subsequently done only through Active Directory. There are broadly three options when using this approach:

1. A one-to-one approach where you create a Tachyon-specific role-based Active Directory group for each Tachyon role. For example, you could create a TCNGApprovers Active Directory security group, and add that group as a user in Tachyon, and then assign the Tachyon  All Instructions Approver  role to the user.
2. A many-to-one approach, where you use one or more of your existing role-based Active Directory groups for each Tachyon role. For example, you could use the Active Directory groups for your desktop and help desk teams, create a Tachyon user for each group, and then assign the Tachyon role to all those Tachyon users.
3. A mixture of the above

Defining a custom Instruction set Tachyon role

If you want to base your Tachyon permissions around access to specific Instruction sets, you will need to create custom Tachyon roles. The Custom Roles section lists built-in custom roles used by Tachyon Applications.

To create a custom role:

1. Navigate to the Settings→Permissions→Roles page.
2. Click the Add button to start the add role process.
3. In the New Role page subsequently displayed set the Name and Description.
4. With the Instruction Sets tab selected, select your required Instruction Sets from the list.
5. Set the Instruction set access rights by checking the required Actioner, Approver, Questioner and Viewer checkboxes.
6. When the associated rights have been set click Save to save your changes and automatically return to the Roles page.
7. You can now add assignments of users and groups and management groups to the new custom role by clicking the link in the Assignments column.
8. Click the + (plus icon) to add a new item and, from the Users and Groups drop-down menu either search for, or select the users or groups you want to associate the role with.
9. From the Management Group drop-down menu either search for, or select the management group you want to associate the role with. This can either be the built-in All Devices or a management group you have created in Settings→Permissions→Management groups.
10. Click the Save button to associate the selected options with the custom role.

The following rights can be set for an Instruction set, these relate to the primary operator roles of the Tachyon system: