Steps for Denying/Deleting an Employee-Level Role

Users assigned to a role may have access to screens and functionality they should not be able to access. These roles can be denied or deleted from the employee record.

• If the role is assigned to the employee through the Organization Unit screen, the role must be added to the employee Role screen with the access set to Denied.
• If the role is inherited by the employee through the Roles screen, the existing role can be updated to be Denied.

  Note: Be sure that the user will still be able to access required screens if the role is removed. Multiple screens and/or functions may be granted to users with a single role.

Roles Directly Assigned to the Employee:

Deleting the Role

1. Click on the Employee button in the tool bar.
2. Using the Employee Search screen, locate the employee whose role is to be updated.
3. Select the Roles button in the employee Actions pane.
4. In the listing of employee-assigned roles, check the box to the left of the role to be deleted.
5. Click on the Delete Selected button in the Role Actions section of the left pane.
6. The role is removed from the employee record.

Denying the Role

An alternative method is to deny the role.

1. Click on the Employee button in the tool bar.
2. Using the Employee Search screen, locate the employee whose role is to be updated.
3. Select the Roles button in the employee Actions pane.
4. Open the record.
   • Set the Denied field to Yes and Save the record.
   • The role still appears in the employee Roles screen. There is a check mark in the Is Denied column to indicate the role is no longer assigned.

Roles Inherited through the Organization Unit Screen:

1. Click on the Employee button in the tool bar.
2. Using the Employee Search screen, locate the employee whose role is to be updated.

   To view inherited roles, from the Employee Sections, select the TCS screen. Open the Employee Authorization Information card, then select the Role tab. All the roles assigned to the employee are listed, including the source where they were assigned.

3. Select the Role option from the Employee Sections in the left pane and click on Add.
4. Enter the Classification and Authorization Role Code for the role that is to be denied.

   Determines the user's authorized access to screens and fields in the application.

   The roles displayed in the Field Look Up Values, and the access allowed by each role, are set up under the Configuration section > System card > Authorization Role screen.

   Determines the type of system classification (for example, Standard, Customer, User Defined, or Replicated).

5. Set the Denied field to Yes.

   Indicates whether the user should be denied permissions to the role at this level (Yes/No). When the Denied field is set to Yes, this overrides any inherited role for this user and removes data access.

   An inherited role is an authorization role that is indirectly assigned to an employee. This role is set up on any level of the Organization Unit screen>Roles section, and is automatically assigned to all employees whose Home labor distribution matches any of the levels of the organization unit. For example, if an employee belongs to a home labor distribution of Corporation A/Facility 1/Department 304/ Unit 1, he or she will "inherit" all the roles set up in the Organization Unit screen for Corporation A and for Facility 1 and for Department 304 and for Unit 1. An inherited role can be overridden at the employee level by assigning the employee the same role but with a different level of access (grant, deny or pass through).

   Note: Inherited roles are not listed in the Roles screen in the employee record. They can be viewed in the employee record on the TCS screen>Employee Authorization Information card.

6. Save the record.
7. The denied Authorization Role is now listed in the grid with a check mark in the Is Denied column.
8. Go back to the TCS screen and open the Employee Authorization Information card, Role tab. Notice that the role has been removed.
9. Repeat steps 4 - 7 for each role to be removed from the employee record.

   Note: To reinstate this role, open the Role screen and check the box to the left of the record to be reinstated. Click on the Delete button. The denial is removed and the role is assigned to the employee.