Plan Permissions

In the Access and Permissions article, you would've understood the accountability and permissions that can be granted, and how permissions provide access control and privacy. Here, let us see how access and permissions work at a granular level in plans.

A plan can either be set as a 

• public plan - setting up either "can edit" or "can view" for all the members of the workspace.

• or, private plan - setting up "no access" to the plan to maintain absolute privacy.  Some benefits of this privacy setting include:

  • building a plan from scratch, and collect feedback before publishing it,

  • remove noise and clutter by enabling only the admins, owners, and collaborators to have visibility and control.

  • restricting confidential data to certain plans

Making a Plan Private

From the Plan settings, you have to enable no access from the permissions drop-down.  This setting will apply to all members of the workspace.

 

User/Team Level Permissions for Private Plans

If you wish to share your private plan with specific users or teams, you can do so by clicking the Share button in the plan of your choice and typing in the users name, name of teams, or email address. These users and/or the team members will then have access to this private plan.

Furthermore, after access has been given in the private plan, you can enable specific users/teams to have either can edit or can view access:

• • assign can edit access to if you wish them to edit the entire plan (including the goals they own if any)

  • or assign them can view access if you wish them to only view the entire plan (if they

  • own any goals, they will be able to only edit their goals while still viewing entire plan).

• Even if you're an owner or collaborator of an objective, you'll not be able to edit its success criteria (measures, actions or projects) when you have can view access assigned. 

• When the owners or collaborators are assigned after the plan access is set to can view, then they'll automatically inherit only view access to the plan. However, they'll be able to edit the goals they work on.

• If you need users with "Viewers" role to collaborate on a goal, then you can assign them as collaborators. Note that they cannot make any edits or progress updates to that goal, and all they can do is just review and leave comments.

• All the members of that team inherit the default view or edit access that you assign the team
• If a team is assigned to a plan at the time of its creation, they will automatically inherit view access
• If the team has a can view access, but the team members own or collaborate on goals, then they'll still be able to edit the goals they work on.
• If a team member is removed from that team, the member will no longer the access that's assigned to the team. However, if the team member owns or collaborates on a goal in the plan or given exclusive view/edit access, then they'll still retain that access to the plan, irrespective of they being removed from the team
  

User Visibility for a Private Plan

If you do not have access to a private plan, then

• The plan is hidden in the All plans, and the Alignment pages.

• The objectives, measures, projects and actions in that plan are hidden. You'll not be able to find the objectives of a private plan in the Objectives library, if you try to link or share objectives.

• The search will not fetch results for entities in a private plan.

• The updates made on the objectives, measures, projects, and actions are hidden in the Home page. However, if someone tags or mentions a person who do not have access to this plan, they'll be notified but the update will be hidden.

• The widgets and report tables are exposed if the dashboard/report are "public", however, you'll not be able to see the details when you click into them to view from their Sidebar. And, when you try to edit the widget or report, you'll not be able to select the private entities from the data source.

• If there's an objective from a private plan that is contributing to a public plan, you'll not be able to see them from the Planner page. However, if you edit that objective from the Sidebar, you'll see a message "This objective contains some private contributing objectives" under the Contributes to area.

• From the Focus area Sidebar, or when you look at the dedicated Focus area page, the plans and the objectives that are private will be hidden.

---

FAQs

How do I know if a plan is private?
You'll see a privacy label across the plan name in the Access column in the Plans page.
If the parent plan is set to private and you do not have access to it, then you'll see the child plans unaligned in the Alignment page and in the Parent plan column, you'll see Private plan instead of the parent plan name.

Can I change the plan owner?
No. But,

• If a plan is assigned to a team, and you change the team owner, then they'll automatically inherit the plan ownership. 

• If there is no team assigned to a plan, then the plan owner would be the one who created it and you'll not be able to change them.

If a private plan is assigned to a team, will the team members automatically inherit edit access even if they're not owners or collaborators in the plan?

The team members will automatically inherit view access to the plan. You need to manually give them edit access from the Share modal.

Why are the focus areas of a private plan visible to everyone?
We do not have privacy permissions for focus areas because focus areas are mostly used as a strategic pillar in which the same focus area(s) can be shared across multiple plans to drive the strategy outcome/alignment. For example, when you create a new plan you can add an "existing" focus area in which all focus areas need to be visible to add this. Although you have a private plan with focus areas only in that private plan, this does not make the name of the focus area private, it only makes the plan itself private.

What do collaborators do?
Like the name suggests, they collaborate on the goals, i.e., add or edit goals, add the existing users in the workspace to the goals, change owners, due dates and targets, add risks and relationships and so on. However, if you wish to restrict their access only to the goals that they collaborate on, then you can assign them can view access from the Share modal.

If an owner or collaborator is removed from a private plan, will the access permissions be retained?
Yes, they'll still retain their original access to the plan. You can revoke it by clicking remove against their name in the share modal.

Can we restrict permissions at a goal level so that the user cannot edit the plans in which they belong. i.e., if we do not want them to update anything except the goals they work on, and at the same time do not want to change their role as “viewer”?
Yes, you can restrict permissions at a goal level too. Set everyone in the workspace to have can view or no access, i.e., making the plan viewable or private. Expand the Owners and collaborators section, assign can view access against those users whom you wish to restrict permissions at their goal level.

While they'll still be able to view the plans and its components, they'll be able to edit only the goals they own or collaborate. Even if they own or collaborate on an objective, they'll not be able to edit its success criteria (measures, actions or projects).

Can a viewer be granted edit permissions? What happens if they're assigned as owner or collaborator in a plan?
Yes, but the permission will default to "can view". If they're assigned as owner or collaborator, they would get added to the share modal with a "can view" access.

I'm drafting an early version, and do not want it to be available to a wider audience. However, I want a few of them to weigh in and give feedback alone.
You can set the plan as private, i.e., "no access" to everyone in the workspace, and give "can view" access to the relevant people from the Share modal. Those who have "view access" can weigh in on your plan.

Can we restrict access and permissions to certain parts of the plan?
No, granular level of access is not supported. Access control is applied to a plan as a whole and cannot be restricted to certain elements of it. If you do not wish to expose some objectives, then we suggest to break down the plan, and move those objectives to a separate plan, and make it accessible to a smaller group.

Can we lock down some fields in the sidebar so that only particular users can edit the locked fields? 

Not at this point. In this case, you can give "can view" access to those people instead of "can edit" so that they do not have permission to edit these fields.

I want the objectives in a private plan to be shared with a public plan but it should not be available to everyone in the workspace.

Yes, in this case only the Admins and the owners and collaborators of those objectives will see this shared objective in the public plan. This objective will be hidden for the others.

What happens when someone who is not an owner or collaborator of a private plan is tagged in the updates or comments made in the plan? Will they automatically inherit edit access?

No. If they're tagged in an update, then they'll receive a notification that someone has mentioned them in an update. However, the update will be hidden when clicking on the notification. Also, it'll be hidden from their home page as well.
In case of being mentioned in a comment, there'll be no notifications and this information is completely hidden.

What happens if a private objective is contributing to a public objective or shared with a public plan?

For users who do not have access to the private plan where this objective sits, they'll not be able to see the contributing objective in their plan. However, when they try to edit their objective from its Sidebar, they'll see a message - "This objective contains some private contributing objectives".

What happens to Updates when a plan is converted to private or when an objective in which the update was made is moved to private plan?

All the updates created before the release of private plans will still be visible even if a plan is converted to private. All subsequent updates made after the plan is set as private will be hidden (includes new updates from an existing plan after it is converted to private).

If an objective is moved from a public plan to a private plan, all the previous updates will remain public, users will have to manually delete them to avoid the wider organization seeing that. All the new updates created after the objective becomes private will be hidden for those who do not have access to this private plan.

What happens when a dashboard or report has data from a private plan?

Private data on dashboards or reports will be visible to all users who have view/edit access to the dashboard or report. If a user doesn’t have access to the private plan, they won’t be able to select it as the data source in the widget or table. Also, when they try to access the context from the Sidebar of the objectives, measures, projects or actions, they'll not be able to see those.

But for a user who has access to the private plan, we want to let the user decide if they want to share the data publicly. We provide the context via a banner on dashboard or report and planner to inform the users so they can convert the dashboard or report to private if they want to keep the information confidential.

A user was removed from the team but I can still see that they hold edit access to the plan. Why?

Check if they own or collaborate on a goal in that plan, If yes, then their access will not be revoked when they're not part of the team and you need to manually change their access from the Share modal.