This seems rather vague, can you be more precise about what you're proposing? Permissions and roles should allow you to create a type of admin user that can only create orgs, locations, and users, and another role that can manage resources assigned to certain orgs.

Dominic Cleal wrote:

This seems rather vague, can you be more precise about what you're proposing? Permissions and roles should allow you to create a type of admin user that can only create orgs, locations, and users, and another role that can manage resources assigned to certain orgs.

This aims to improve granularity for roles/permissions system to flexibly support specific multitenancy needs.

It should be possible to create a 'Foreman admin' role, that would be allowed to manage taxonomies and assign subscriptions. 'Foreman admin' should also be allowed to create new users with appropriate rights to manage resources only within specific taxonomies, thus creating 'Organization X admin' role. 'Foreman admin' should not be able to manage any resource within any organization, except for users, their permissions and inevitably also user roles. Note that despite their names, both 'Foreman admin' and 'Organization X admin' are regular users and do not have admin flag set to true, because permissions for admin are not checked and they have access everywhere. But regular users cannot assign permissions (there are no permissions to delegate permissions), only admin can do that. Maybe I missed something, but I was not able to achieve the desired outcome and therefore I consider this a valid RFE.

Ondřej Pražák wrote:

But regular users cannot assign permissions (there are no permissions to delegate permissions), only admin can do that.

*_roles permissions allow new roles to be created or to edit roles, which allows permission assignment.

Non-admin users with *_users permissions can assign roles that they themselves have, but doesn't permit assignment of other roles to users (so as to prevent escalation of the user's permissions)

Maybe I missed something, but I was not able to achieve the desired outcome and therefore I consider this a valid RFE.

Perhaps, but I'm trying to ensure this is precise enough to be fixed. What is the part that isn't implemented? The assignment of permissions to roles by non-admin users (which I think is possible), or the assignment of non-owned roles to users?

You are right, the assignment of permissions to roles by non-admin users is possible, I was missing *_filters permissions. The assignment of non-owned roles to users needs to be implemented.