Issue Within Lightspeed Filter, Admin Role permissions can indicate that an administrator has permission to manage a function or object, while actual access may still require an additional object-level assignment or collaborator assignment. This creates a disconnect between what the Admin Role configuration appears to grant and what the administrator can actually access after the role is assigned. For administrators configuring least-privilege access, the current wording can reasonably be interpreted as meaning that the selected role permission is sufficient by itself. Example An administrator may be assigned a role containing permissions associated with managing a particular feature or object. However, after receiving the role, the administrator may still be unable to access that object until they are separately added as an owner, collaborator, or other required assignment. The additional assignment requirement is not sufficiently clear from the Admin Role configuration itself. Operational Impact This creates unnecessary administrative troubleshooting because it can be difficult to determine whether: the role was configured incorrectly; the role failed to apply; the administrator lacks another required permission; or the administrator simply requires an additional object-level assignment. It also makes least-privilege role design more difficult because administrators cannot determine the complete access requirements from the role configuration alone. Requested Enhancement Update the Lightspeed Filter console and supporting Admin Roles documentation so that permissions requiring additional assignments clearly state that requirement. Where applicable, permission descriptions should identify: whether the role permission alone grants access; whether an additional object-level assignment is required; what type of assignment is required, such as Owner or Collaborator; and whether the requirement differs between Policies V1 and Policies V2. Preferred Console Behavior A permission that requires an additional assignment should communicate that directly in the Admin Roles interface. For example: Manage Access Lists Allows the administrator to manage Access Lists for which they have been assigned the required Owner or Collaborator access. Rather than wording that could imply the administrator automatically receives access to all Access Lists after the role permission is enabled. Requested Outcome Ensure that Admin Role permissions accurately communicate the difference between: role-level authorization, and additional object-level assignment requirements. The goal is not to change the existing security model, but to make the existing access model clear and predictable to administrators configuring roles. Acceptance Criteria This request would be considered addressed when: Permissions requiring additional object-level assignments are clearly identified in the Admin Roles interface. The required assignment type is documented. Differences between Policies V1 and Policies V2 are clearly identified where applicable. Administrators can determine from the console or directly linked documentation whether granting a role permission alone will provide functional access. The wording no longer implies broader access than the administrator will actually receive.
