Workiva Support Center

In Workiva, your ability to access and interact with a feature is set according to your role. Roles allow companies to scope an employee's access to only the tools necessary for their job. Once a role is assigned, access can be further restricted through the use of permissions — such as the ability to view or edit a particular file. Chains follows this same model, but includes a subset of permissions unique to Chains.

This guide will walk you through how to create user groups in Chains, assign appropriate roles, and set up the necessary permissions.

Step 1: Create the Chain Owners user group

To start, someone with the Chain Security Admin role will need to create new user groups and sort staff members into them. These groups will define the abilities that each person has in your software.

At minimum, you must create a Chain Owners group that permits users to view, run, edit, and create chains.

Here's how:

1. From Workiva Home, click your profile icon at the top right.
2. Select Workplace Settings from the pulldown menu.
3. Select the Groups tab.
4. Click Create Group on the right side.
   
5. Name this group Chain Owners.
6. Now add workspace members to this group by searching for or selecting individuals. Remember that users in this group will have the ability to view, run, edit, and create chains.
7. Click Create Group to finish.

You'll set the permissions for this group in Step 4.

Note: Need more help? Click here to see our full article on setting up user groups.

Creating additional user groups

You've now set up a Chain Owner group that has complete access to chains. This is the only required group, but you may want to allow other users to access chains as well.

In this case, we recommend following the steps above to create two additional groups:

• Chain viewers: This group has view-only access to Chains.
• Chain runners: This group can view and run chains, but can't modify or create them.

Step 2: Bulk assign new user roles

Now that you've set up user groups for your staff members, you'll need to assign each person an updated role.

Here's what we recommend:

• Remove the Chain Owner role from all Chains users: This legacy role grants admin access to all Chains settings and objects. It is no longer necessary and may allow users unwanted access to your chains.
• Assign the Chain Builder role to all Chains users: The Chain Builder role grants access to the Chains platform itself, but grants no other abilities on its own.
• Assign the Chain Security Admin role to at least one person: This role allows the administrator to assign permissions to other users. At least one person must have this ability.

To update your members' roles, follow these steps:

1. From Workiva Home, click your profile icon at the top right.
   
2. Select Workplace Settings from the pulldown menu.
3. Select the Members tab, and mark the checkbox next to each user whose roles you want to edit.
   
4. Click Edit in the toolbar, and select Roles.
   
5. In the Edit Roles dialog, mark or clear to apply or remove a role from all the selected users. A dash in a checkbox indicates that some of the selected members already have this role.
   
6. Click Apply Changes in the toolbar to finish.
   

Alter individual user roles

1. From Workiva Home, click your profile icon at the top right.
   
2. Select Workplace Settings from the pulldown menu.
3. Select the Members tab, double-click on the user whose roles you want to edit.
   
4. In the Workspace Roles dropdown menu, click on each role that you want to add to the user. To remove a role, click the X next to that role in the user row.
5. Click the blue checkmark icon to accept your assignments.
6. Click Apply Changes in the toolbar to finish.
   

Note: Need more help? Click here to see our full article on changing roles.

Step 3: Set permissions for your new groups

At this point, your members should be assigned their new roles and groups. The final step is to assign unique permissions to each group; these permissions, in turn, will decide the level of access granted to each staff member.

Note: You will need to have the Chain Security Admin role assigned to you to complete this task.

Here's how to assign permissions:

1. From Workiva Home, click Chains in the left nav menu.
2. In the new Chains tab, click your profile icon at the top right.
   
3. Select Chains admin from the pulldown menu, and select Workspace Settings from that.
   
4. Select Users & Permissions in the navigation bar at the top,
5. From the Permissions tab, select the Chain Owners group.
   
6. Under Permissions on the right side, click the Creator checkbox to mark them. Your changes will save automatically.
   

At this point, you've finished applying permissions to the Chain Owners group. If you created other groups, such as Chain Viewers or Chain Runners, repeat this step and choose the appropriate permissions for that group.

Note: Once chains have been created, clicking Chain Permissions opens a window where you can assign or remove Read, Execute, Edit, and Admin permissions for individual chains.

Step 4: Remove permissions from the Default user group

All new Chains users are automatically placed in the Default user group. This user group is only visible in Chains and will not appear in the rest of Workiva. It cannot be deleted or removed.

Because this group includes everyone in your workspace, we recommend removing most of its permissions.

Note: Before proceeding with this step, make certain that all users are assigned to other groups with appropriate permissions. Removing permissions from the Default group removes them from all users who are assigned to only this group.

1. In Chain Builder, click Settings at the top left.
2. Select Users & Permissions in the navigation bar at the top,
3. From the Permissions tab, select the Default user group in Chains Permissions.
   
4. On the right side, uncheck the boxes to remove all permissions. Your changes will save automatically.

Understanding permission levels

Permission levels in Chains are leveled and correlated, meaning some permissions are automatically enabled when a higher-level permission is enabled. For instance, the Creator permission will automatically grant the Executor and Editor permission.

Please note that not all checkboxes can be selected within a workspace.

Note: Viewer and Admin permissions cannot be assigned at the Workspace level. Viewer permission is a default permission given to all members of the workspace, and Admin permission is granted by the user's role.

FAQ

Can I assign permissions to individual chains?

Yes, but this does require Environment Security Admin rights in the chain's parent environment.

Learn more about assigning permissions to individual chains