Copyright ©2025 Fabric | Xytech Help Document Version 1.13

Need Help? Start Here — Welcome to Xytech Help | Xytech Basics | Xytech Notable Features | Using the Help - Best Practices | Xytech Support Web Site 

 

---

Document Rights Tab Page

Xytech Standard Role Application – Document Rights Tab Page

The Document Rights Tab Page is used to establish which documents users assigned to the current role have access to and what level of access they have. The settings on this page will govern as many layouts (including reports) that have been created for each document.

The Document Rights Area is organized by module. When you first add documents to the area, each will be listed under its parent module. When the record is saved, the area will reorganize and the added documents will all be listed under the appropriate unified module header.

You can add new line items to this tab page by clicking the Plus icon  in the navigation bar at the bottom of the page.

NOTE

View Only security is granted to a User when rights for the specified document have not been assigned. If the view rights are revoked from any of the report forms they will not be viewable, regardless of the rights codes.

DETERMINING WHICH DOCUMENTS TO ADD

To determine if a document is necessary to add to the current role, consider the following:

Overall Access Rights

If any document regardless of document type is not added to this tab page, users will have view-only access to all layouts created from the document. (That is, by default, all users have view-only access to all layouts.)

Access through Modules Pane

• If a SEARCH LIST (a.k.a. Select) document is not added to this tab page, users assigned to the current role will not see layouts created from those types of documents in the Modules pane. If such layouts are available from within other applications that the user does have access to, the user will be able to open and use those search list windows.
• If an APPLICATION MAINTENANCE (a.k.a. Maintenance) document is not added to this tab page, users assigned to the current role will not have access to layouts created from those types of documents via the associated New submenu in the Modules pane. If such layouts are available from within other applications that the user does have access to, the user will be able to open and view those Maintenance windows.
• If a Setup document is not added to this tab page, users assigned to the current role will not see layouts created from those types of documents in the Modules pane. If such layouts are available from within other applications that the user does have access to, the user will be able to open and view those Setup items.
• If a Utility document is not added to this tab page, users assigned to the current role will not see layouts created from those types of documents in the Modules pane. If such layouts are available from within other applications that the user does have access to, the user will be able to open and view those Utility items.
• If a document that has a report layout linked to it is not added to this tab page, users assigned to the current role will not see that report in the Modules pane (if applicable). If such layouts are available from within other applications that the user does have access to, the user will be able to access and print those reports.

Denying View-Only Access Rights

If you do not want users assigned to the current role to have view-only rights to layouts created from a document, you must add the document to this tab page and uncheck the Can View Doc Field. This is important to do with documents that contain sensitive information, such as, Billing Code, Invoice Batch, and Purchase Order. (See below for ROLE SECURITY information).

Granting Additional Access Rights

If you want users assigned to the current role to have more than view-only rights to layouts created from a document, you must add the document to this tab page and assign rights as detailed in the ESTABLISHING SYSTEM SECURITY STEP-BY-STEP topic.

Role Area Field Definitions

Description

Displays the description established for the current role record on the Security Role Tab Page. You can edit the value in either location.

Active

Displays the active status for the current role record as established on the Security Role Tab Page. You can edit the value in either location.

 

Xytech Role Document Rights Settings

Creating or Modifying an Exising Role

When creating a new Role, or modifying an existing Role, click on the Document Rights tab:

1.     In the ‘Documents Rights’ area click on the Plus icon  to add a new Document to which you will assign rights.

2.     In the Document column, select ‘Dashboard’. NOTE: There is both a ‘Dashboard’ and a ‘Dashboards’ selection to choose from, select ‘Dashboard’.

3.     The Document Types column will autopopulate with ‘Maintenance’. This field cannot be changed.

4.     Select all of the permissions being granted to this Role for this Document. Ensure that any permissions NOT being granted to the Role are unchecked.

5.     In the ‘Rights Codes’ area, highlight all 'Available Items' (the box on the left) to which the Role will have the assigned security access. Left-click and hold on the items in the 'Available Items' and drag them to 'Selected Items' (the box on the right). 

6.     Any Items moved to the 'Selected Items' box in error, or that are being removed from the Role’s security profile, can be moved back to the 'Available Items' box by highlighting the Item(s), then left-click and hold on the items and drag them to the 'Available Items' area.

7.     Once all the required documents for this role have been moved to Selected Items, click the Save icon  or the Save & Close button .

Accessing the documents controlled through the Dashboard security settings carries the same Rights Code settings for the document(s) regardless of from where in Xytech the document is called up.

Example 1: If a User should have access to Grid Update and Rapid Update records their Role must have the Allow Grid and/or Rapid Update Rights Codes in the Selected Items section.

Example 2: If a User has the Document Rights of ‘Save Layout Changes’ or ‘Customize Layout Buttons’ in the Dashboard module, then they will be able to Save Layout Changes or Customize a Layout Button regardless of the document they are working in (e.g. Job Maintenance or Work Order Maintenance).

RIGHTS CODES AREA DEFINITION

RIghts functionality for documents are set when creating or modifying a Role that is assigned to the Users. In the ‘Document Rights’ area you can set the access rights to several documents (see list below). The ‘Dashboard’ maintenance document rights assigned to the Role will be treated as ‘Global Settings’, and the Dashboard maintenance rights codes, if selected, will apply to all relevant documents/UIs the user has rights to access. 

As per other documents, should a user have two roles with different Dashboard Settings, the ‘most permissive’ access settings will be allowed.

Access to the following documents are controlled through the Dashboard security settings:

• Additional Contacts
• Create Xytech Web Client charts * (1)
• Save Xytech Web Client dashboards * (1)
• View Xytech Web Client Navigator * (1)
• Xytech Web Client Themes (1)
• Xytech Web Client Layout tools menu (1)
• Create Xytech Web Client Web Gadgets * (1)
• Customize Buttons +
• Save Layout Changes +
• Grid Update + (3)

 

NOTE

For Sites updating from an earlier version of Xytech, a conversion script provided by Xytech will give rights to all the above for Dashboard documents on Roles. This script must be run by the Site’s System Administrator.

 

+ IMPORTANT: These rights have been removed from individual documents and added to the ‘Dashboard’ document

 

*Grid/Rapid Update ONLY controls the grid/rapid update from lists, NOT maintenance docs (e.g. Order Actuals). 

This Docuement will only display values if the document selected has unique functionality available for access control (e.g., the Invoice Batch Application includes the following functions: Generate Invoices, Post Batches, Remove Invoices, and/or Unpost Batches).

The Available Items section lists functions that are not accessible by users who have been assigned to the current role when working with the selected document via any of its layouts. Functions listed in the Selected Items section are available to the current role’s users.

To add a function from the Available Items section to the Selected Items section, select an Available Item, left-click and hold the Item, then drag it to the Selected Items section. To remove an item from the Selected Items section, left-click and hold the Item, then drag it to the Available Items section.

 

NOTES

• The rights code Shared View Exclusive Editing Rights that is available when the Schedule View item has been selected in the Document Field allows you to control those users who can edit shared views (i.e., the Is Shared Field is checked in the Schedule View Window). Users assigned to the role with this rights code selected will also be able to delete any scheduling view if the Can Delete Doc Field has also been checked. If the rights code has not been selected for any of a user’s roles, that user will not be able to delete any scheduling views.
• The rights code Allow Edit Approved that is available when the PO Invoice Reconciliation item has been selected in the Document Field enables users assigned a role with this rights code to modify an approved (but not posted) PO invoice reconciliation record in the same manner as one can modify an unapproved record. (The user will be able to delete rows, add rows, change quantities and totals, etc.) This will benefit those users – as well as integrations via API calls – who need to make changes to an approved PO invoice reconciliation record without going through the Unapproval process.
• The rights code Allow Edits after Invoicing that is available when the Work Order, Media Order, or Transmission Order items have been selected in the Document Field enables users assigned a role with this rights code to edit certain values on an order after it has been invoiced that would not be otherwise editable (e.g., Order Description, Order Type, all custom fields attached to the order header). (This rights code is not available on the Order Transactions documents; transactions will remain uneditable after invoicing.)
  IMPORTANT!
  If you have customizations or are using custom posting methods that depend on values of orders to remain constant after invoicing, you must use caution in using this rights code.
  Certain features will only be available for users that have been assigned a role that has rights codes configured on the Dashboard document. Select the Dashboard item from the Document Field and allow access to four unique rights codes as necessary:
  • Create Xytech Web Client Charts — Users assigned a role with this rights code will be allowed to create charts or save edits of existing charts in Xytech Web Client. The Charts Area of the Xytech Web Client Navigation Panel will be hidden if this rights code is not added to the Selected Items section.
  • Create Xytech Web Client Web Gadgets — Users assigned a role with this rights code will be allowed to create gadgets or save edits of existing gadgets in Xytech Web Client. The Gadgets Area of the Xytech Web Client Navigation Panel will be hidden if this rights code is not added to the Selected Items section.
  • Save Xytech Web Client Dashboards — Users assigned a role with this rights code will be allowed to create and save dashboards in Xytech Web Client.
  • View Xytech Web Client Navigator — Users assigned a role with this rights code will be allowed to view the Navigation Panel in Xytech Web Client. Users assigned a role without this rights code will see that:
    • The Navigator is collapsed
    • Only the Logout button shows
    • The Settings menu is not available
    • The Navigator cannot be expanded
    • Such users will only be able to access default dashboards and the items saved to those dashboards.

• The rights code Change Scheduled Report of Other Users that is available when the Scheduling Report item has been selected in the Document Field allows users assigned a role with this rights code to edit any SCHEDULED REPORT regardless of owner.
• The rights code Delete MO Movement that is available when the Library Movements, Movement – In, Movement – Move, or Movement – Out items have been selected in the Document Field allows users assigned a role with this rights code to delete a movement record that is linked to a service row on the Media Order or Transmission Order Maintenance Applications. If such movement records are deleted, any sources linked to the associated service row will be unlinked and the service row will be deleted. Any dependencies on the service row will also be removed. The deletion will only be allowed if the order is open and editable. If the order is locked (e.g., invoiced), neither the service row nor the movement will be deleted.
  IMPORTANT!
  Users assigned this rights code will be able to delete the service row linked to the selected movement even if those users do not have rights to delete or even access service rows within media / transmission orders. This means that users do not need to have rights to the Media Order or Transmission Order documents.
• The rights code Prevent Labor Roster/Off Time Edit that is available when the Scheduling Resource item has been selected in the Document Field prohibits users assigned a role with this rights code from modifying, adding, or deleting any line items on the Roster / Off Times Tab Page of scheduling resource records if those records have the Labor Field checked (i.e., resources that represent people instead of equipment). Those records with the Labor Field unchecked are not controlled by this rights code.
• The rights code Off Time Request Only that is available when the Roster Time Off item has been selected in the Document Field prohibits users assigned a role with this rights code from creating, deleting, or editing any roster off time booking that is not assigned to their EMPLOYEE PROFILE resource and is not assigned an OFF TYPE that has the Request Field checked. When such users create a new off time booking from the Resource Maintenance Application’s ROSTER / TIME OFFS TAB PAGE, their associated resource will default and may not be changed and they may only assign off types with the Request Field checked.

DOCUMENT RIGHTS AREA FIELD DEFINITIONS

Module

This read-only field displays the module to which the selected document is assigned.

Document

Use this field’s drop-down list to select a document.

Document Type

This read-only field displays the type of document selected in the Document Field.

Can View Doc

This checkbox determines whether or not users who have been assigned to the current role can view layouts created from the selected document in the Modules pane and throughout the system.

LAYOUT VISIBILITY

All users are granted view-only access to layouts (via their parent document) by default, but those layouts will not be visible in the Modules pane unless the parent document is added to this tab page and this field is checked. (Maintenance layouts will only appear in the New submenu of the Modules pane if the Can Create Doc Field has also been checked.)

When this field is checked for a document, that means that any layouts created from it will be available in the Modules pane and accessible anywhere throughout the system. For example, if the Work Orders Search List Window is assigned to be visible for the current role, all users that have been assigned to that role will see and have access to the layout wherever it is available, such as, the Modules pane, the Work Orders Tab Page of job records, or the Invoice Work Order Batch Application.

Can Edit Doc

This field will only be available if the Can View Doc Field has been checked.

This checkbox determines whether or not users who have been assigned to the current role can edit records created from the selected document via any of its layouts.

NOTE

If this field is unchecked and the Can Create Doc Field is checked, when users are assigned to the current role, they will be allowed to initially add field values when creating records based on this row’s assigned document; however, when a new record is first saved, it will become read only for the user. (Settings on the Document Column Rights Tab Page will apply.)

Can Create Doc

This field will only be available if the Can View Doc and the Can Edit Doc Fields have been checked.

This checkbox determines whether or not users who have been assigned to the current role can create records created from the selected document via any of its layouts.

NOTE

If this field is checked and the Can Edit Doc Field is unchecked, when users are assigned to the current role, they will be allowed to initially add field values when creating records based on this row’s assigned document; however, when a new record is first saved, it will become read only for the user. (Settings on the Document Column Rights Tab Page will apply.)

Can Delete Doc

This field will only be available if the Can View Doc and the Can Edit Doc Fields have been checked.

This checkbox determines whether or not users who have been assigned to the current role can delete records created from the selected document via any of its layouts.

NOTE

The system will prevent any user from deleting order records (work order, media order, and transmission order) to protect critical accounting information.

Can View Attach

This field will only be available if the Can View Doc Field has been checked.

This field determines whether or not users who have been assigned to the current role can view attachments linked to records created from the selected document via any of its layouts.

Additionally, if the value Inherit has been assigned to this field, the system will use the settings established on the Attachments document (Doc ID 10435).

ATTACHMENTS DOCUMENT FUNCTIONALITY

The Yes and No options in this field control user view access to attachments on a per document level.

If the Inherit value is assigned to this field, the system will use the value set on the Can View Field of the Attachments document (Doc ID 10435). This allows you to control attachments access at a global level for a role; changing the Can View Field setting on the Attachments document will be carried to all other documents with the Can View Attachment Field set to Inherit.

For example, you create a role that has the Can View Field checked on the Attachments document but the Can Edit, Can Create, and Can Delete Fields unchecked. You then add the Bid, Job, and Work Order maintenance documents to the role and set all of the attachments security fields to Inherit. Users assigned that role will be able to view any existing attachments linked to bids, jobs, and work orders, but they will not be able to add or delete any.

 

XYTECH CLOUD NOTES

• Attachments support is available if you access Xytech Web Client via the Xytech Cloud and you store files on a file-hosting service (e.g., OneDrive, Dropbox).
  For users accessing Xytech Web Client via the Xytech Cloud, it is recommended that you create a special layout for the Attachments document (check the Xytech Web Client Field in the LAYOUT PROPERTIES WINDOW and uncheck the Windows Client and Phone Fields) that includes the Attachment Column (i.e., the same as the Xytech Standard layout).
• Xytech Cloud customers using the Smart Client version of Xytech may not use the attachments feature as it is a security risk.
  For users accessing the Smart Client via the Xytech Cloud, it is recommended that you create a special layout for the Attachments document (check the Windows Client Field in the LAYOUT PROPERTIES WINDOW and uncheck the Xytech Web Client and Phone Fields) that does not include the Attachment Column. This will prevent users from adding or opening files regardless of security settings.

Can Add/Edit Attach

This field will only be available if the Can View Doc Field has been checked.

This field determines whether or not users who have been assigned to the current role can add attachments linked to records created from the selected document via any of its layouts or update the description of an existing attachment. (Once saved, users will not be allowed to change the file name or the file contents of an attachment.)

Additionally, if the value Inherit has been assigned to this field, the system will use the settings established on the ATTACHMENTS document (Doc ID 10435).

ATTACHMENTS DOCUMENT FUNCTIONALITY

The Yes and No options in this field control user add access to attachments on a per document level.

If the Inherit value is assigned to this field, the system will use the value set on the Can Edit and Can Create Fields of the ATTACHMENTS document (Doc ID 10435). This allows you to control attachments access at a global level for a role; changing the Can Create Field setting on the Attachments document will be carried to all other documents with the Can Create / Edit Attachment Field set to Inherit.

For example, you create a role that has the Can View Field checked on the Attachments document but the Can Edit, Can Create, and Can Delete Fields unchecked. You then add the Bid, Job, and Work Order maintenance documents to the role and set all of the attachments security fields to Inherit. Users assigned that role will be able to view any existing attachments linked to bids, jobs, and work orders, but they will not be able to add or delete any.

XYTECH CLOUD NOTES

• Attachments support is available if you access Xytech Web Client via the Xytech Cloud and you store files on a file-hosting service (e.g., OneDrive, Dropbox).
  For users accessing Xytech Web Client via the Xytech Cloud, it is recommended that you create a special layout for the ATTACHMENTS document (check the Xytech Web Client Field in the LAYOUT PROPERTIES WINDOW and uncheck the Windows Client and Phone Fields) that includes the Attachment Column (i.e., the same as the Xytech Standard layout).
• Xytech Cloud customers using the Smart Client version of Xytech may not use the attachments feature as it is a security risk.
  For users accessing the Smart Client via the Xytech Cloud, it is recommended that you create a special layout for the ATTACHMENTS document (check the Windows Client Field in the LAYOUT PROPERTIES WINDOW and uncheck the Xytech Web Client and Phone Fields) that does not include the Attachment Column. This will prevent users from adding or opening files regardless of security settings.

Can Delete Attach

This field will only be available if the Can View Doc Field has been checked.

This field determines whether or not users who have been assigned to the current role can delete attachments linked to records created from the selected document via any of its layouts.

Can View Log

This field will only be available if the Can View Doc Field has been checked.

This checkbox determines whether or not users who have been assigned to the current role can view the Log Window on records created from the selected document via any of its layouts.

Can Export

This checkbox determines whether or not users who have been assigned to the current role may have access to the Save as XML command from the Options submenu of the Actions Button menu of the selected document via any of its layouts.

Additionally, this same field controls whether or not users who have been assigned to the current role may have access to the Export Selected Rows command from the right mouse button menu available on list blocks for the selected document via any of its layouts.

Can View Action Menu

This checkbox determines whether or not users who have been assigned to the current role may have access to the Action menu for the selected document via any of its layouts.

ROLE SECURITY

When creating a Role to assign to a set of Users, there may be a requirement to limit the ability of the User to Create and/or Save a Search. Limiting this ability is done through the Security Role assigned to the User and the Document Rights granted to that Security Role.

To limit the ability of a User to Create and Save a Search, in the System > Roles area open the existing Role, or create the new Role, to be assigned to the User. In the Document Rights area of the Document Rights tab, select both System > Search Criteria and System > Search Criteria List

Xytech System > Roles > ‘Role’ > Document Rights

Uncheck ‘Can View Doc’ for each of these abilities and the User assigned this Role will not have the ‘Saved Searches’ link presented on their Search screen.

NOTES

• Unchecking ‘Can View Doc’ will also uncheck ‘Can Edit Doc’, ‘Can Create Doc’ and ‘Can Delete Doc’ (existing functionality).
• System Administrators are able to assign a Saved Search to the User as their default, and that Search will be performed when the Search is invoked, but the User will have no ability to select a different Saved Search.

 

 

>