Permissions matrix¶
Who can do what across Picsha DAM, Picsha Admin and Picsha Lab. Permissions belong to roles, set in Picsha Admin under Users, Roles and permissions; every person has one role. Groups decide which assets a person sees (Who can see an asset); roles decide what they may do with them.
Every organization starts with three roles, filled in the way the legacy DAM treated each kind of user. Administrators can change any of them or add more.
| Can | Admin | Member | User | Set by |
|---|---|---|---|---|
| Sign in to Picsha DAM and browse the assets their groups may see | yes | yes | yes | membership |
| Download originals and renditions | yes | yes | yes | Download |
| Order prints and products | yes | yes | yes | Order |
| Upload files | yes | yes | no | Upload assets |
| Choose any audience when uploading, including @all | yes | no | no | Who the uploader may share with |
| Have uploads approved without review | yes (waits for review in the legacy preset) | yes | n/a | Approval of their uploads |
| Change who can see their own uploads | yes | no | no | Change who can see their own uploads |
| Change who can see any asset | yes | no | no | Change who can see any asset |
| Open the image or document editor | yes | yes | no | Edit |
| Save, promote and delete versions | yes | yes | no | Version |
| Move assets to the trash | yes | yes | no | Delete |
| Share with people or by link | yes | yes | no | Share |
| Approve or reject assets | yes | no | no | Approve |
| Change metadata on assets other offices uploaded | yes | add only | no | Change only what their own people ingested, and the metadata table |
| See and change each metadata field | per field | per field | per field | the role's metadata table |
| Use the filters in the DAM | per field | per field | per field | the Facet column of the metadata table |
| View dashboards and reports | yes | no | no | Analytics |
| Add or change dashboards, tiles and reports | with Manage dashboards | no | no | Manage dashboards |
| Enter creative-services requests | yes | no | no | Creative Order |
| Sign in to Picsha Lab | yes | no | no | Lab: Access (every member of a Lab-only organization can) |
| Open Picsha Admin | yes | no | no | Admin: Access |
| Manage users, groups, roles and settings in Picsha Admin | yes | no | no | Admin: Access |
| Issue Lab connector keys and manage printers in Picsha Lab | yes | no | no | Admin: Access |
Notes:
- Admin: Access grants every other permission except Manage dashboards, and lets the person decide any step of an approval workflow.
- A person with Approve needs Overwrite on the Asset Status field, because approving is done by setting that status.
- Change only what their own people ingested limits Edit, Version, Delete, metadata changes and audience changes to assets uploaded by the person or by someone in one of their groups. Viewing, downloading, ordering, sharing and approving are never limited.
- In Picsha Lab, every signed-in member can operate the queue; only administrators change Settings, Printers and the Lab Connector.
- Platform staff from Picsha act as administrators of every organization they support.