Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-01-09
Create Child Security Roles

Create Child Security Roles

Have these permissions:
  • settings.admin
  • rbac.roles.create
  • rbac.roles.read
  • rbac.roles.update
Child Roles are specialized types of roles that can be included within standard roles. This allows for a more granular and efficient approach to assigning permissions. Instead of directly assigning numerous individual permissions to each role, you can create focused child roles containing specific sets of permissions and then include these child roles within broader parent roles.
Child roles are applicable to individual user roles and individual vendor roles. They are not supported for profile roles, such as all employers and all vendors, or directly bound roles like Statement of Work (SOW) participant roles.
A child role can apply even if its parent role does not. Child roles are evaluated independently of their parent roles.
  1. From the header, select
    More
    Company Settings
    .
  2. Under
    Security
    , click
    Security Settings
    .
  3. Click
    Create Role
    .
  4. As you create the role, consider:
    Option Description
    Name
    Required to create a new role. Identifies the role.
    Description
    Enables you to provide additional details about the role.
    Role Usage
    Indicates the permissions that can be applied, as well as the types of users who can have this role
    Policy
    You can use this to limit the role to specific resources or situations. See: Set Up Security Policies.
    Is Child Role?
    When checked, indicates the role you're creating is a child role. Child roles cannot be directly assigned to users, and must be added to another role.
    Permissions
    You can find all permissions and their definitions on the
    Permissions
     tab of the
    Security Roles
     page. Use these definitions to make sure that you're selecting the correct permissions for the role.
  5. Click
    Save
    .
You need to grant your vendors the ability to create Worker Profile Management (WPM) work orders but want to prevent them from editing existing External Workforce Management (EWM) work orders. Currently, the vendor roles lack the
workorder.modifications.create
 permission, preventing them from creating WPMs. However, directly, adding
workorder.modifications.create
 to the existing vendor roles would inadvertently grant them editing access to EWM work orders, which is undesirable.
  1. Create security roles for Vendor Admin and Vendor Manger. These will serve as the parent roles.
  2. Create a Policy to restrict the
    workorder.modifications.create
     permission to only apply to WPM work orders.
  3. Create a child role for Vendor WPM Edit and select the policy created in step 2.
  4. Edit the Vendor Admin and Vendor Manager roles and select the child role you created.
When a vendor is assigned either of the parent roles, they inherit the child role. The Vendor WPM Edit child role grants them the necessary permission to create WPM work orders without inadvertently providing them with the ability to edit EWM work orders.