Application Multi-Role Management-website-阿里云帮助中心

When multiple employees in an enterprise collaborate to manage an application, different positions require access to different menus and business content. Application Multi-Role Management isolates permissions by role so that each employee can work only within their responsibilities. Administrators can also adjust employee roles at any time without modifying program code.

Note

You can enable this feature separately. However, if you enable Standalone website admin console, "Multi-Role Management" is forcibly enabled.

Enable the feature

Below the conversation area, click the Skill icon.
Select [Wanxiaozhi] Application Multi-Role Management and describe your multi-role management requirements.

For example: "We need three roles: owner, employee, and regular user."

Sign-in mechanism: All users share the same sign-in entry and sign in with an email or mobile verification code, so they do not need to remember a password. Before the initial rollout, make sure that the work email addresses and mobile numbers of the enterprise owner and all employees can receive verification codes.

Role system

The system includes the following role types:

Role type	Description
Super Admin	A built-in role with the highest permissions. This role cannot be deleted. For instructions on how this role is created, see Initial rollout procedure. Important The system automatically sets the first user who completes a verification-code sign-in as the Super Admin. If you do not want an employee to become the Super Admin, make sure that the employee does not complete their first sign-in before the administrator.
Custom Role	A role that an administrator creates based on the organizational structure of the enterprise, such as product operations or content editor. Administrators can freely configure the menus and action buttons that the role can access.
Regular User	The default initial role, which has the lowest permissions. New employees automatically become Regular Users after their first sign-in and wait for an administrator to assign a working role.

You do not need to select a role manually when you sign in. The system automatically displays the appropriate interface based on the roles assigned to the account. A new employee who signs in for the first time has no assigned role and enters the interface as a Regular User. After a role is assigned, the employee must refresh the page or sign out and sign back in to see the interface for the new role.

Initial rollout procedure

The Super Admin role is automatically assigned during sign-in and does not need to be created in advance or selected manually.

To assign permissions correctly, we recommend that you follow this sequence during the initial rollout:

Ask employees to wait: Tell all employees not to open the sign-in page yet.
Have the owner sign in first: The enterprise owner or the designated system administrator must open the sign-in page first, get a verification code with their work email address or mobile number, and sign in. That user automatically becomes the Super Admin.
Confirm permissions: After you sign in, check whether the Administration Console entry appears in the menu bar on the left. Continue only after you confirm that the account has the highest permissions.
Allow employees to sign in: After the administrator confirms that their permissions are correct, notify the other employees to sign in one at a time.

After their first sign-in, employees remain Regular Users and cannot yet see the menus and business content for their positions. The Super Admin must then assign a working role for each employee.

Assign roles to employees

Employees are not automatically assigned a working role after their first sign-in. The Super Admin must assign working roles manually. Working roles come from the custom roles that an administrator creates. If the target role does not exist yet, first create a role.

Have the employee sign in: The employee signs in with a verification code sent to their work email address or mobile number and automatically becomes a Regular User.
Find the employee: The Super Admin chooses Administration Console > System > Roles and Permissions > Member Management, and then finds the target employee in the member list by email address or mobile number.
Assign a role and save: Select a working role for the employee (such as sales manager, procurement specialist, finance staff, production supervisor, or project manager), and then click Save.
Verify the result: Ask the employee to refresh the page or sign out and sign back in, and then confirm that the menus and business content are displayed correctly for the role.

Manage roles and permissions

Choose Administration Console > System > Roles and Permissions > Role Management. This module lists all roles in the current system, including Super Admin, Custom Role, and Regular User. It supports the following operations:

Configure Permissions: Click Configure Permissions for the role, select the menus and action buttons that the role can access, and then click Save Changes.
Create Role: Create more specific roles based on the organizational structure of the enterprise to support fine-grained management. A maximum of 10 business roles are supported.
Delete Role: Before deletion, the system prompts that this operation affects the assigned members and their permissions. Proceed with caution. Built-in system roles cannot be deleted.