.. _additional-role-access-profile-validation:

Additional Role Access Profile Validation
-----------------------------------------

For users with system administrator privileges 
to the ``data/Settings`` model, a setting called 
Additional Role Access Profile Validation is available 
as a check box to manage the available roles when an
administrator creates Access Profiles.

* When the Additional Role Access Profile Validation check box is *enabled*:

  An administrator can only assign a role to a user if it is linked
  to an access profile with permissions that are in the subset of the
  administrator's own access profile. Role drop-down lists will therefore be restricted.

  If the macro function ``fn.filter_roles_by_user_access_profile`` is used, the
  setting needs to be enabled for roles to be filtered.

  This validation check also applies when administrators manage multi-role admin users - where
  the role is associated with an Authorized Admin Hierarchy.

* When the Additional Role Access Profile Validation check box is *disabled*:

  An administrator can assign any role to a user, regardless
  of the administrator's own access profile. Role drop-down lists will therefore
  not be restricted.

  If the macro function ``fn.filter_roles_by_user_access_profile`` is used, the
  roles will *not* be filtered.

  This validation check also applies when administrators manage multi-role admin users - where
  the role is associated with an Authorized Admin Hierarchy.

By default, the Additional Role Access Profile Validation is disabled.

Refer to the macro topic Filter Role Functions for details
on the use of the ``fn.filter_roles_by_user_access_profile``
function.


.. |VOSS Automate| replace:: VOSS Automate
.. |Unified CM| replace:: Unified CM