Customize ownership

Deviating from the previous status, in the example scenario the 'ownership relationships' are now to be adjusted to the hierarchical relationships, so that the Owner (2) matches the parent company (1).

►IMPORTANT◄ This principle ('ownership ≈ hierarchy') should not be misunderstood as the best practice for a real project. It is only used here to demonstrate the effects of permissions. In practice, there may be good reasons to structure the company hierarchy and ownership differently. However, the interaction between Roles, ownership, company hierarchy and the Company authorizations presented here must always be carefully deliberated, coordinated and controlled after implementation to ensure access is granted where necessary and denied where inappropriate.

In concrete terms, only those child company accounts that are indirectly subordinated to 'Smart Logistics AG' must be modified, since these are the only ones for which the parent company still differs from the owner:

• The company 'SL LDN' should be transferred into the possession of 'SL UK'.

• The companies 'SL BER' and 'SL MUC' shall be transferred into the ownership of 'SL Germany'.

In the ribbon of the Company account overview of the main category Administration, the subcategory Change owner provides a combobox that displays the current owner and allows a new assignment via dropdown:

In the screenshot, the company 'SL LDN' was selected in the list so that its detailed data is displayed. In the ribbon the change of ownership from 'Smart Logistics AG' to the already parent company 'SL UK' should now be done by Change owner.

Problem: When opening the combobox, the company 'SL UK' does not appear in the dropdown.

Conclusion: In order for the desired changes by 'Smart Logistics AG' to be feasible at all, access to the relevant company accounts must be guaranteed even after the change of ownership.

The respective new owner must allow 'Smart Logistics AG' access to the company accounts for this purpose. More precisely, a company authorization must be set up to enable this access. The 'new owner' has no active role in this process. 'Smart Logistics AG' can set up the required authorization itself.

►NOTE◄ In the given situation, the only alternative to changing the owner would be to use the role 'Super User', in whose context the 'owner restrictions' are ignored. However, this option should only be used in truly exceptional cases and not out of convenience, since the frivolous use of this 'extraordinary means' quickly leads to constellations of dependencies that are hardly manageable without such special rights and are unnecessarily intransparent for less privileged users. Only if access rights are 'cleanly regulated' by permissions, a controlled and orderly division of labor is possible for administrative tasks that require special permissions (e.g. to edit configurations), but which should only be performed with a limited radius of action (e.g. in a part of the company hierarchy).

Company authorizations

The Administration/Accounts/Company authorizations menu path opens the overview of all existing Company authorizations that can be accessed in the context of the current session:

Permission inheritance

In contrast to the previous example, a user who logs on with the role 'Administrator' in the context of 'Smart Logistics AG' will receive all authorizations for all directly and indirectly subordinate companies, i.e. the entire hierarchy.

Similar to the above procedure, it is possible to give explicit permission for 'Smart Logistics AG' at the top of the hierarchy, starting from any subordinate company in the company structure. In the example with only five affected companies, this approach may still seem feasible. However, it must be taken into account that every time the company structure is expanded by an additional company, the corresponding permissions must also be considered. Under practical conditions, significantly more extensive company hierarchies are often the case, so that the creation of explicit permissions for all relevant 1:1 relationships in the hierarchy quickly becomes too inefficient and confusing.

With the help of Permission inheritance, which supports Lobster Data Platform / Orchestration in the definition of company permissions, the definition of a single company permission is sufficient to fulfill the objective pursued here.

For this purpose, the definition of the already created permissions should be adjusted as follows:

The permissions that have just been set up provide an administrator operating on central level with unrestricted access to all child companies in the hierarchy below.

In more complex application cases, it is often required that administration can be carried out by different parties on different hierarchical levels for the respective child companies.

The existing permissions should therefore be adjusted accordingly:

On the basis of the last adjustment of the company authorization the following image results:

• The black arrows indicate the hierarchical relationship from the child to the parent company.

• Green arrows indicate that a company grants permissions (here: 'all') to another company.

In the example scenario, each company can now act on behalf of directly and indirectly subordinate companies.

On this basis, the outstanding changes for the 'ownership' within the structure should now also be completed!

The result should be reflected in the company account overview as follows:

• Although 'Smart Logistics AG' only owns the subordinate companies 'SL Germany' and 'SL UK', their subordinate companies still appear in the overview.

• For all listed companies the Owner matches the parent company.

►NOTE◄ A closer look reveals that the final statement does not apply for the company 'Smart Logistics AG' at the top of the hierarchy, which is owned by the 'Default Company'. Deleting the Owner of 'Smart Logistics AG' might sound useful, to perfectly align columns Owner and Parent companies. However, this is not recommended, since Lobster Data Platform / Orchestration treats entities without an owner as 'common property' for which no owner restrictions apply.

► Continue with Creating external companies