Employee Groups

Employee groups bundle employees for shared deal visibility, task routing, and permission management.

What groups do

Groups serve three purposes:

  • Deal visibility — when a deal is shared with a group, all members of that group can see it. See working with deals.

  • Task routing — business processes assign user tasks to candidate groups. A candidate group in a process definition resolves to an employee group. See user tasks and forms.

  • Permission scope — the "group" scope in the permission model grants access to records shared with a specific group. See roles and permissions.

Creating a group

Create groups in the Employee Groups section. A group has a name and optionally a parent group and a group type.

Groups can form a hierarchy: a group can have a parent group. Model your organizational structure as the group tree — for example, regions containing teams.

A new employee is not automatically added to any group. You must add each employee to groups explicitly after creating their account.

Machine name

Every group has a machine name, the identifier by which other systems know the group. The LDAP directory uses it as the name of the group’s entry, and OpenID Connect lists it in the groups claim. Applications that map groups to their own roles can rely on it, because it never changes.

Setting Behavior

Field

Machine name, with the hint "Generated from the name if left empty. Cannot be changed after the group is created."

Format

Latin letters, digits and the underscore _, starting with a letter, at most 64 characters.

Uniqueness

Unique within the organization, ignoring case. A duplicate is refused with "A group with this machine name already exists".

After creation

The machine name is shown as a value in the group form and cannot be edited.

When you leave the field empty, CityScreen Deals derives the machine name from the group name:

  1. The name is transliterated into Latin letters and written in lower case.

  2. Every run of other characters becomes one , and at the start or the end is removed.

  3. A name that would start with a digit gets the prefix g_.

  4. When another group already has that name, the suffix _2, then _3 and so on is added to the new one.

For example, a group named "Sales North" gets the machine name sales_north.

If you type a machine name that does not follow the format, the form shows "The machine name must start with a letter, contain only Latin letters, digits and underscores, and be at most 64 characters long".

Group e-mail

A group can have an e-mail address, so that it works as a mailing list address. Mail servers that read the LDAP directory can expand this address into the members of the group.

Setting Behavior

Field

E-mail, with the hint "Makes the group usable as a mailing list address." The field is optional, and you can change or clear it at any time.

Uniqueness

No other group may have the same address, ignoring case: "Another group already has this e-mail address".

Employee addresses

The address must not belong to an employee account: "This e-mail address belongs to an employee account". This keeps the mail of an employee from being expanded as mail for a group.

An address that is not a valid e-mail address is refused with "The e-mail address is not valid". The LDAP directory publishes the address as mail on the entry of the group, and it publishes only groups that have members.

Membership and member roles

When you add an employee to a group, the membership carries a member role — a label such as "supervisor" or "member". The same employee can hold different member roles in different groups.

The member role is an organizational label within the group. It is unrelated to the permission roles described in roles and permissions.

The group member role is unrelated to the process candidate group mechanism. Being a supervisor in a group does not affect which process tasks you receive. Tasks are routed to all members of the candidate group regardless of member role.

Group types

Each group can have a group type that defines a default member role and can carry custom fields defined through the entity type system.

Group types are defined through the entity system.

Default roles on groups

A group can have a default role — a permission role that is assigned to employees by virtue of their membership in the group. An employee’s effective permissions are the union of all roles from all groups they belong to.

See roles and permissions for how permissions accumulate.

Related pages