Permissions in Nuclos run through user groups: general rights, module rights for business objects with a state model, and master-data rights without one. On the state model, status-dependent field rights are added. Nuclosian explains this model and creates groups and assignments.

What to distinguish in business terms

General rights control system functions such as running reports, exporting Nuclets, or using the web client. Module rights govern read, write, and delete on the business object. In the status matrix, colours typically mean read and write, read-only, or hidden. Subforms have their own create and delete symbols. Multiple groups on a user resolve to the higher permission level. Superuser bypasses this by design.

Without a clear group model you get shadow access or process blocks. Permissions belong in process clarification, not as afterthoughts after go-live.

What Nuclosian takes on

Keep Rechte and Benutzergruppe in the prompt, plus who may see or change what. Nuclosian writes groups and rights directly into the instance. There is no diff for that. Overview: First steps.

Technical reference in the wiki

Groups and permission tabs: Benutzergruppen in the Nuclos wiki. Status-dependent matrix: Statusmodell. The wiki is the detail reference. This page explains the decision picture.

What to clarify next

• Which roles map to which user groups?
• Which fields are read-only in which state?
• Who may export or import Nuclets?