Performance Analytics roles

Assign roles to ensure that users can perform all necessary actions.

Roles and personas

Warning: Giving someone the pa_admin or pa_data_collector role is equivalent to giving them admin, from a security perspective.

<table id=“table_ydm_wzd_4v”><thead><tr><th>

Role

</th><th>

Authorizations

</th><th>

Typical persona

</th></tr></thead><tbody><tr><td>

No role

</td><td>

• View Performance Analytics visuals on the Service Portal.

• View dashboards that have been shared with this user.

Some dashboards require a subject matter related role for viewing, such as sn_hr_core_basic for the HR Agent dashboard. Dashboard owners and administrators can also restrict dashboard access by role. For more information, see Dashboard permissions.

</td><td>

Requester who does not need any access to Performance Analytics beyond certain visualizations of results

</td></tr><tr><td>

Any role (not necessarily a Performance Analytics role)

</td><td>

• Open the indicator library

• Create dashboards.

• Restrict access by role to a dashboard they create.

• Share dashboards they own.

</td><td>

</td></tr><tr><td>

pa_viewerContained by: All roles except pa_contributor

</td><td>

Before Quebec, this role was necessary for the following actions. It may still be necessary on upgraded instances.

• View Analytics Hub.

• Create personal thresholds and targets for indicators.

• Read, Update, and Delete thresholds and targets that they created.

• View text analytics widgets on dashboards.

</td><td>

Requester who needs and understands the details of key performance indicators

</td></tr><tr><td>

sn_pa_diagnostics.pa_diagnosticContained by: pa_admin

</td><td>

• Read from the Diagnostics tables.

• Activate or deactivate a diagnostic.

• Run diagnostics.

• Delete message records and diagnostic logs.

</td><td>

No specific persona, but this role would typically be assigned to individual business analysts or groups of fulfillers.

</td></tr><tr><td>

pa_contributorContained by: pa_power_user, pa_admin

</td><td>

For indicators for which the user is designated as a Contributor:- Read and update scores in scoresheets. - View the Analytics Hub.

This user can also read dashboards that have been shared with them.

</td><td>

No specific persona, but this role would typically be assigned to individual fulfillers or groups, who are allowed to set indicator scores manually

</td></tr><tr><td>

pa_kpi_signal_adminContained by: admin

</td><td>

Enables the user to dismiss a signal or reset the baseline for KPI Signals.

</td><td>

Process owner who also has some training in Performance Analytics. Also needs the pa_viewer role.

</td></tr><tr><td>

pa_target_adminContained by: pa_power_user, pa_admin

</td><td>

• Create targets.

• Read, update, and delete all targets, including those that they do not own.

• Assign targets to indicators.

</td><td>

Manager who knows what targets to set but may not have any further input to Performance Analytics

</td></tr><tr><td>

pa_threshold_adminContained by: pa_power_user, pa_admin

</td><td>

• Create global thresholds.

• Read, update, and delete all thresholds, including those that they do not own.

• Assign thresholds to indicators.

</td><td>

Manager who knows what thresholds to set but may not have any further input to Performance Analytics

</td></tr><tr><td>

pa_analystContained by: pa_power_user, pa_admin

</td><td>

• CRUD text analytics keywords, phrases, and stop words

• Read indicator sources.

</td><td>

No specific persona, but this role would be assigned to individual fulfillers or groups whose expertise includes keywords, phrases, and stop words for word clouds.

</td></tr><tr><td>

pa_power_userContained by: pa_admin

The pa_power_user role contains the viz_admin, pa_viewer, pa_contributor, pa_target_admin, pa_analyst, and pa_threshold_admin roles.

</td><td>

• CRUD indicators and breakdowns.

• CRUD widgets

• Add Performance Analytics widgets to dashboards.

• CRUD text index configurations for text analytics.

• CRUD bucket groups.

• CRUD indicator groups

</td><td>

Business analyst and visualization designer. Understands the use cases for Performance Analytics and the requirements for indicators and breakdowns.

</td></tr><tr><td>

pa_data_collectorContained by: pa_admin

</td><td>

• CRUD, schedule, and run data collection jobs

• CRUD indicator and breakdown sources

• Read some system properties

• CRUD system units

• CRUD scripts and automated notifications

• CRUD bucket groups

• Activate or deactivate Data snapshots

</td><td>

Technical expert who understands the underlying database record structure of Performance Analytics

</td></tr><tr><td>

pa_adminThe pa_admin role contains the pa_power_user, sn_pa_diagnostics.pa_diagnostic, viz_admin, and pa_data_collector roles.

</td><td>

• Read Performance Analytics properties.

• Access Admin Console

• Launch Dependency Assessment

</td><td>

Performance Analytics technical expert who also understands business needs.

</td></tr><tr><td>

admin

</td><td>

The system administrator role. Users with the admin role can perform all pa_admin functions, edit properties, create database views, CRUD any dashboard, and assign ownership to dashboards.

</td><td>

System administrator

</td></tr></tbody> </table>## Spotlight roles

<table id=“table_qrp_kxz_dhb”><thead><tr><th>

Role

</th><th>

Authorization

</th><th>

Typical persona

</th></tr></thead><tbody><tr><td>

pa_spotlightContains: pa_viewer, pa_spotlight_copy_breakdown

</td><td>

CRUD Spotlight groups and criteria.

</td><td>

Expert who understands the business logic of what records require reminders.

</td></tr><tr><td>

pa_spotlight_viewer

</td><td>

Access to the dashboards from the Analytics and Reporting Spotlight Solutions.

</td><td>

Fulfiller who needs more than simple Priority setting to remind them of records that require action.

</td></tr><tr><td>

pa_spotlight_copy_breakdown

</td><td>

Can copy Spotlight groups to multiple elements of a breakdown.

</td><td>

Spotlight expert or business analyst who understands the applicability of a Spotlight group by breakdown element.

</td></tr><tr><td>

pa_spotlight_copy_domain

</td><td>

Can copy Spotlight groups to multiple domains

</td><td>

Domain administrator with Performance Analytics expertise

</td></tr></tbody> </table>## Role hierarchy

Certain roles such as pa_power_user and pa_admin include other roles. For example, pa_power_user includes pa_contributor. This diagram shows the role hierarchy.

[Omitted image “pa_role-hierarchy.png”] Alt text: The pa_admin role hierarchy.

Required roles for actions

<table id=“table_sps_5pq_d2b”><thead><tr><th>

Module

</th><th>

Action

</th><th>

Minimal required role

</th></tr></thead><tbody><tr><td>

Admin Console

</td><td>

Access

</td><td>

pa_admin

</td></tr><tr><td>

Analytics Hub (Scorecards)

</td><td>

View

</td><td>

None, since Quebec. However, upgraded instances may still require pa_viewer.

</td></tr><tr><td>

Automated indicators

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr><tr><td>

Automation schedules

</td><td>

Read and delete (other security restrictions likely apply)

</td><td>

pa_data_collector

</td></tr><tr><td>

Automation scripts

</td><td>

CRUD

</td><td>

pa_data_collector

</td></tr><tr><td>

Breakdowns and elements, including breakdown relations

</td><td>

CRUD

</td><td>

pa_data_collector or pa_power_user

</td></tr><tr><td>

Bucket groups

</td><td>

CRUD

</td><td>

pa_data_collector or pa_power_user

</td></tr><tr><td>

Color schemes for charts and targets

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr><tr><td>

Dashboards (Responsive or Platform Analytics)

</td><td>

Create a dashboard. Update a dashboard they created, including restricting access by role.

</td><td>

Any roles necessary to access the data to display, or any one role

</td></tr><tr><td>

Data snapshots

</td><td>

Activate or deactivate

</td><td>

pa_data_collector

</td></tr><tr><td>

Responsive dashboards

</td><td>

Add Performance Analytics widgets to responsive dashboards you own.

</td><td>

pa_power_user

</td></tr><tr><td>

Dashboards (Responsive or Platform Analytics)

</td><td>

Read a dashboard that has been shared with you

</td><td>

No role by default, but dashboards can require roles to view their data. For more information, see Dashboard permissions.

</td></tr><tr><td>

Dashboards (Responsive or Platform Analytics)

</td><td>

Update, delete, or share a dashboard that you own.

</td><td>

pa_power_user

</td></tr><tr><td>

Dashboards (Responsive or Platform Analytics)

</td><td>

Update, delete, or share any dashboard. Reassign ownership of any dashboard.

</td><td>

admin (and dashboard role dashboard_admin)

</td></tr><tr><td>

Data collector jobs

</td><td>

Read, write, execute

</td><td>

pa_data_collector

</td></tr><tr><td>

Dependency assessment

</td><td>

Launch dependency assessment from indicator or breakdown form

</td><td>

pa_admin

</td></tr><tr><td>

External indicators and breakdowns

</td><td>

CRUD

</td><td>

pa_data_collector or pa_power_user

</td></tr><tr><td>

Formula and manual indicators

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr><tr><td>

Indicator Groups

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr><tr><td>

Sources, either indicator or breakdown

</td><td>

CRUD

</td><td>

pa_data_collector

</td></tr><tr><td>

Indicator targets

</td><td>

Read and edit targets that you do not own

</td><td>

pa_target_administrator

</td></tr><tr><td>

Indicator targets or thresholds

</td><td>

Create new. Read or edit ones you own.

</td><td>

None, since Quebec. However, upgraded instances may still require pa_viewer.

</td></tr><tr><td>

Indicator thresholds

</td><td>

Read and edit thresholds that you do not own

</td><td>

pa_threshold_administrator

</td></tr><tr><td>

In-form analytics

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr><tr><td>

KPI Signals

</td><td>

Reset baseline or dismiss signal

</td><td>

pa_kpi_signal_admin

</td></tr><tr><td>

Lists in all applications

</td><td>

Access an interactive analysis

</td><td>

No role by default, but some interactive analyses require roles to view their tables

</td></tr><tr><td>

Manage diagnostics

</td><td>

Read, execute, delete

</td><td>

sn_pa_diagnostics.pa_diagnostic

</td></tr><tr><td>

Scheduled email summary jobs

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr><tr><td>

Scoresheets

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr><tr><td>

Service Portal

</td><td>

View Performance Analytics visuals

</td><td>

No role

</td></tr><tr><td>

System Properties

</td><td>

Edit

</td><td>

admin

</td></tr><tr><td>

System Properties

</td><td>

Read

</td><td>

pa_data_collector for some, pa_admin for all

</td></tr><tr><td>

System Units

</td><td>

CRUD

</td><td>

pa_data_collector

</td></tr><tr><td>

Text Analytics

</td><td>

Set up text index configurations

</td><td>

pa_power_user

</td></tr><tr><td>

Text Analytics

</td><td>

View a text widget on a dashboard

</td><td>

None, since Quebec. However, upgraded instances may still require pa_viewer.

</td></tr><tr><td>

Text analytics keywords, phrases, or stop words

</td><td>

CRUD

</td><td>

pa_analyst

</td></tr><tr><td>

What’s on the Move News Rules and Statistics Generators

</td><td>

Read, edit

</td><td>

pa_power_user

</td></tr><tr><td>

Visualizations that contain indicator information

</td><td>

CRUD

</td><td>

pa_power_user

</td></tr></tbody> </table>Parent Topic:Performance Analytics reference

Related topics

Dashboard permissions

Administering reports