Set folder permissions

Note: You can set permissions for a folder only if you are a PI Vision administrator or your PI AF identities grant you Manage or Admin permissions for the folder.

For each folder that you create in AVEVA PI Vision, you need to apply permissions to indicate which users in your organization are allowed to view, edit, and manage the folder.

Depending on how you set up permissions overall, folder permissions can determine which users in your organization have access to which displays. For example, you can choose to set up your permissions so that when a user has access to view a folder, it means that the user has access to view all the displays that are contained in that folder. This is accomplished by simply setting each individual display to inherit its permissions from its folder.

Alternatively, you can customize the permissions for each individual display, so that the permissions for a display's folder do not determine which users can access the display. With that approach, folder permissions may be less important, as they control access and rights to the folder structure itself, without affecting access to displays. However, if users have access to numerous displays but they do not have access to folders, the displays may be more difficult to find as they will not appear within the organizational structure provided by folders (users can find those displays together in one list under All Displays, or use the displays' URLs to navigate to them directly).

To set folder permissions, you apply folder permissions to PI AF identities. When permissions are granted to an identity, all the users that are assigned to the identity receive those permissions. If a user is assigned more than one identity and those identities have any permissions that conflict (the user is both allowed and denied the same permission by different identities), the conflicting permissions are denied for the user.

Follow the steps below to set folder permissions.

1. From the left pane on the home page, select the folder and then click Edit folder settings to open the Folder Settings window.

   The dialog lists all PI AF identities. Identities that are not assigned any permissions for the folder are on the left and identities that are assigned permissions for the folder are on the right.

   Note: If Overridden by ancestor appears in the window, it means that you are working with a subfolder whose parent uses Override permissions on descendants. This option locks all subfolders' permissions, so that they are identical to the parent folder's permissions. You cannot modify the permissions for the folder unless first you go to the parent folder and unselect Override permissions on descendants.

2. If you are working with a folder that is directly under Home (it does not have a parent folder), proceed to the next step.

   If you are working with a subfolder (it has a parent folder), select Inherit from [folder name] if you want to apply the same user permissions as those that are saved for the parent folder. Note the following:

   • You can grant additional permissions to what is inherited from the parent folder, as well as modify the inherited permissions. To change the inherited permissions for an identity, select Custom.

   • If permissions are changed on the parent folder, folders that inherit those permissions update automatically with the new permissions. Any non-inherited permissions that were manually applied are retained.

   • If the folder is moved to a different parent folder, inherited permissions are not retained, but any non-inherited permissions that were manually applied are retained.

   • If you have multiple levels of subfolders, permission inheritance may be chained across the folder levels. For example, changing the permissions on a top-level parent folder will change the permissions of a sub-folder three levels down when Inherit from is enabled on all folders under that parent.

3. To give an identity permissions on the folder, select the identity in the Unassigned AF Identities list, then select the arrow to move it to the list of identities with permissions. Once it is moved, the identity is given Read access by default, which you can change as needed in the next step. Continue to move all the identities that you want to grant permissions to. Any identities that remain unassigned on the left side of the window will not have any permissions for the folder, so that those identities do not have permission to view the folder.

4. Set the permissions for the identities as appropriate. The options are described below.

   Read

   The identity's users can:

   • View the folder as well as any of the folder's displays and child folders that the identity's users have Read access to.

   Write

   Provides all Read permissions, plus the identity's users can:

   • Create new displays in the folder and move existing displays into the folder.

   • Save copies of displays in the folder.

   • Create new subfolders.

   Manage

   Provides all Write permissions, plus the identity's users can:

   • View and configure folder permissions.

   • Rename the folder.

   • Move the folder.

   • Delete the folder.

   Administrator

   Provides all Manage permissions, plus administrator permissions on the folder, its displays, all its subfolders, and all its subfolders' displays. The identity's users can:

   • Grant Folder Administrator access to other identities for this folder and its subfolders.

   • View all displays that exist within the folder and its subfolders, which could include displays that other users set up to be private.

   • Change the owner of the displays that exist in the folder and its subfolders.

   Note: If you have the Administrator permission you can view all displays that exist within the folder, however other users' private displays do not appear unless you select Show private displays.

   Custom

   Allows you to set custom permissions for the identity. This option may be used for two main reasons. First, if you are working with a subfolder that inherits its permissions from its parent folder, you can select Custom to modify an identity's inherited permissions. Second, for any folder, you can select Custom if you want to explicitly deny permissions for an identity. Explicitly denying a permission differs from not granting the permission in that it:

   • Ensures that the permission is denied for all users who are assigned the identity even if permissions are inherited from the parent folder which would otherwise grant that permission to the identity.

   • Ensures that the permission is denied for all users who are assigned the identity even if any of those users are also assigned other identities that would otherwise grant the permission.

   • Ensures that the permission is denied for all users who are assigned the identity on any child subfolders or displays that inherit their permissions from this folder.

5. Select Override permissions on descendants if you want to apply the same permissions to all the folder's subfolders, displays, and subfolders' displays, with no modifications to the permissions allowed for those descendants. If you want the descendants to use the exact same permissions, this option helps save time and it can also eliminate the chance of mistakes in the descendants' permissions. If you apply this option then later modify the permissions for this folder, the modified permissions are also automatically applied to the descendants. If you apply this option then later unselect it, the descendants reinstate the permissions that were last saved before this option was applied.

6. Select Save.