Issue

Under the current Policies V2 model, an administrator may have an Admin Role that grants Access List permissions but still be unable to manage individual Access Lists unless they are separately added as an Owner or Collaborator.

This creates an unnecessarily restrictive default model.

The preferred design is the inverse:

If an Admin Role grants Access List access, the administrator should have access to all Access Lists within that role's scope by default. Restrictions should then be applied only when needed.

This is more scalable and still supports Least Privilege Access because the role itself determines whether the administrator has Access List privileges at all.

Preferred Permission Model

Access List permissions should operate in two layers.

The Admin Role should first determine whether the user has access to the Access List function.

For example:

Access Lists

Allow

Not Allowed

If Access Lists are Not Allowed, the user has no Access List access.

If Access Lists are Allowed, the user receives access to all Access Lists within the scope of the role by default.

Administrators should then have the option to restrict that role or user to specific Access Lists when a narrower scope is required.

The model should therefore be:

Default:

All Access Lists allowed

Optional restriction:

Limit access to selected Access Lists only

This is preferable to the current model:

Current:

All Access Lists restricted by default, with each list individually granted.

Example

Central Filter Administrator

Role configuration:

Access Lists: Allowed

List Restrictions: None

Result:

The administrator can manage all Access Lists without being manually assigned as a Collaborator to each one.

Limited Administrator

Role configuration:

Access Lists: Allowed

List Restrictions: Enabled

Permitted Lists:

Department A Allow List

Department A Block List

Result:

The administrator can manage only those selected lists.

Administrator Without Access List Responsibilities

Role configuration:

Access Lists: Not Allowed

Result:

The administrator has no Access List access.

Why This Model Is Preferred

This approach preserves Least Privilege Access while avoiding unnecessary administrative overhead.

Least Privilege Access should determine which functions a role is authorized to perform and allow further restriction where necessary.

It should not require administrators with legitimate district-wide Access List responsibilities to be individually assigned to every object they are already authorized to manage.

The current restrictive-by-default object model creates:

repetitive collaborator assignments;

additional maintenance when new lists are created;

unnecessary work during staffing changes;

inconsistent behavior between Admin Role permissions and actual access;

increased troubleshooting when a role appears authorized but the user cannot access the object.

Requested Enhancement

Modify Access List permissions so that:

Admin Roles include a global Allowed / Not Allowed Access List permission.

When Access Lists are Allowed, all Access Lists within the user's role scope are accessible by default.

Administrators may optionally enable restrictions limiting that user or role to selected Access Lists.

Individual Owner/Collaborator assignment remains available where object-level restriction is intentionally required.

New Access Lists automatically remain accessible to administrators whose role has unrestricted Access List access.

Acceptance Criteria

This request would be considered addressed when:

Access Lists can be globally set to Allowed or Not Allowed within Admin Roles.

A role with Access Lists set to Allowed receives access to all applicable Access Lists by default.

Administrators can optionally restrict a role or user to selected Access Lists.

Unrestricted administrators do not require individual Collaborator assignments.

Restricted administrators remain limited to explicitly permitted lists.

Newly created Access Lists automatically inherit access for unrestricted Access List administrators.

The console clearly indicates whether access is:

globally allowed;

globally denied; or

allowed with list-level restrictions.

Business Value

This model would:

align Access List permissions with Least Privilege Access principles;

reduce unnecessary administrative overhead;

preserve granular restrictions when they are actually needed;

make Admin Role permissions accurately reflect functional access;

simplify onboarding, staff transitions, and maintenance;

make Access List administration more scalable in large environments.

The preferred model is therefore:

Allow by role → restrict only when required

rather than:

Restrict everything → individually allow every list.