Security Options

Pyplan provides a comprehensive set of security features for managing users and their permissions. Each user can be assigned access to specific companies and configured with distinct departments and roles, ensuring precise control over what they can view and modify within the platform.

User Manager

Users, roles, and departments are managed from the User Manager, available under Security options → Users.

In this section you can:

• View the complete list of users for the selected company.
• Create new users (if you have the required permissions).
• Edit existing user profiles, including their roles and department assignments.

User Creation

To create a new user, access the Add user option in the User Manager.

Fill in the required fields: First Name, Last Name, Email, Username, and Password. Additional options include:

• Require user to change password on login.
• Enable multi-factor authentication.

Select the main role for the user. Then choose, for each company you want to assign the user to, the departments and role they belong to.

When a user belongs to multiple departments, a Main Department must be selected. The Main Department determines which department's resources and defaults are applied first.

warning

If a user is assigned to more than one department, a Main Department must be set. If it is not set, the backend will choose one arbitrarily, which may lead to incorrect behavior or unexpected resource assignments.

A user may have a specific role for a given company. If so, when the user logs into that company, all permissions are determined by that specific role. If the user does not have a company-specific role, they will inherit all permissions from their main role.

Edit Users

To modify existing users from the User Manager:

1. Select the user in the list.
2. Use the Edit user option in the toolbar to change profile data, roles, or departments.
3. Use the Change password option to update the user's password only.

Changes take effect immediately after saving.

Roles

A role is a collection of permissions assigned to a user within the platform. Roles can be assigned and customized according to the needs of each organization.

Roles are created by accessing the Add role option in the top menu. Select the company to which the role will belong, define the name, and choose one of the templates that has a set of default permissions configured. Permissions can then be modified in the Permissions by role option.

Permissions by Role

The Permissions by role option lets you modify which actions each role can perform.

• Permissions are grouped by module (Applications, Interfaces, File Manager, Workflow, etc.).
• Expanding a group shows detailed permissions.
• For each permission, enable or disable access per role by checking or unchecking the corresponding checkbox.

Default Role Permissions Table

Module	Permission	Administrator	App Administrator	Creator with Public Access	Creator	Explorer	Viewer	Login Only	Super Admin
Applications	Create apps	✓	✓	✓	✓				✓
	Create versions and scenarios	✓	✓	✓	✓				✓
	View diagram	✓	✓	✓	✓				✓
	Save changes in private space	✓	✓	✓	✓				✓
	Save changes in Public app	✓	✓	✓					✓
	Set permissions in diagram modules	✓	✓						✓
Interfaces	View interfaces	✓	✓	✓	✓	✓	✓		✓
	Add, modify, or delete interfaces	✓	✓	✓	✓	✓			✓
	Set interface permissions	✓	✓						✓
File Manager	View File Manager	✓	✓	✓	✓				✓
	Add/modify/delete files (private)	✓	✓	✓	✓				✓
	Add/modify/delete files (Public)	✓	✓	✓					✓
	Set permissions on files/folders	✓	✓						✓
External Links	Create/modify/delete API endpoints or interface links	✓	✓	✓	✓				✓
Workflow	Manage processes	✓	✓						✓
Scheduled Tasks	Create/modify/delete scheduled tasks	✓	✓	✓	✓				✓
Teams	Add/modify/delete Teams	✓	✓						✓
Departments	Add/modify/delete departments	✓	✓						✓
Instances	View company instances	✓	✓						✓
	Deactivate company instances	✓	✓						✓
Roles	Create/modify/delete roles								✓
Companies	Create companies								✓
	Modify companies	✓							✓
General Settings	Modify General Settings	✓							✓

Departments

Departments control access to data and resources at an organizational level. They can:

• Restrict access to specific folders in the File Manager.
• Restrict access to certain interfaces or modules.
• Define the hardware specifications for the instances used by their members.

From the Department Manager you can view existing departments, edit them, or create new ones using Add department, where you specify:

• Department name.
• Company it belongs to.
• Resources.

Teams

Teams allow you to group users within a company so they can share applications and files only with other members of that Team. Each Team has its own folder in the File Manager (under the Teams folder), accessible only by Team members.

From the Team Manager you can view existing teams or add new ones. For each team you define:

• The name of the Team.
• Which departments have access and with which level: Read-only or Read/Write.

Companies

In Pyplan, each company defines an isolated environment where its users can work together and share files and applications. From the Company Manager you can create new companies and edit existing ones.

When creating a new company, define:

• The company name.
• The folder name where all files belonging to that company will be stored.

To activate a new company, assign a Pyplan license, which determines:

• For how long the company is enabled.
• The maximum number of users allowed.

Manage company-level preferences by selecting a company and clicking the Preferences button.

Single Sign-On (SSO) with SAML

To enable SSO with SAML, add a preference called SAML Configuration with the following JSON structure:

{
  "groups": ["Name of Group"],
  "definition": {
    "service": {
      "sp": {
        "idp": { ... },
        "single_sign_on_service": { ... }
      },
      "name": "Company name",
      "endpoints": { ... }
    },
    "entityid": "string",
    "metadata": { ... }
  },
  "departments": ["departmentCode"],
  "main_department": "string"
}

Key fields:

• groups: Roles to assign to the user when created. Values must match existing role names in Pyplan.
• definition: JSON containing all SAML configuration details (company name, IdP information, connection metadata, etc.).
• departments: Department codes to assign to the user when created.
• main_department: Main department code for resource usage.

Role Mapping

To define default roles and departments based on values from Active Directory, add a preference called Role Mapping:

{
    "role": {
        "ManagerFromActiveDirectory": "Administrator",
        "CustomUserActiveDirectory": "Creator"
    },
    "department": {
        "SalesActiveDirectory": ["pyplan-default", "guest"],
        "InvitedActiveDirectory": "guest"
    }
}

Grant/Deny Access to Information

In Pyplan, you can manage access permissions to specific items — such as folders, modules, and interfaces — per department. This allows, for example, departments like Accounting and HR to have different visibility and access within the same application.

How it works

For each department you can either allow or deny access to selected items:

• If an item is in the allowed list, the department can access it.
• If an item is in the denied list, the department cannot access it.

Pyplan automatically resolves conflicts:

• If an item is added to the allowed list, it is removed from the denied list.
• If an item is added to the denied list, it is removed from the allowed list.

File Manager folders are matched by name, so a rule on a folder reaches every folder called the same way in the company. We can single out specific folders with exempt paths.

What you can control

For each department you can manage access to:

• Interfaces and interface folders
• Modules in the influence diagram
• Folders in the File Manager

Example 1: Configuring permissions for interfaces

From the Interface Manager:

1. Select one or more interfaces whose access you want to change.
2. Open the permissions dialog.

The dialog lets you choose between:

• Deny access to selected departments, or
• Allow access only to selected departments.

After applying the change, the interface shows a padlock icon to indicate restricted access.

Example 2: Configuring permissions for modules

To restrict access to diagram modules:

1. Select one or more modules in the influence diagram.
2. Right-click to open the context menu.

The dialog lets you choose between Deny or Allow access to selected departments.

When access to a module is denied for a department, users from that department will not see those modules when opening the diagram.

Example 3: Configuring permissions in the File Manager

In the File Manager, you can restrict one folder at a time:

1. Navigate to the folder you want to restrict.
2. Open its options menu.
3. Use the same permissions dialog.

Exempt paths on folder rules

A rule on a File Manager folder matches by folder name, so it reaches every folder called the same way in the company, including folders that belong to different applications. That is convenient when the same structure repeats across applications, but sometimes one particular folder has to behave differently.

Exceptions cover that case. The rule keeps matching by name, and we list the exact folders it must not reach. Exceptions are configured per department, so two departments can be exempted on different folders.

To add an exception:

1. Open the folder's permissions dialog, as described in Example 3.
2. Choose the rule under Set permissions — Deny access or Allow access only to — and select the departments.
3. Under Exceptions, every selected department shows its own list. We select Add exception on the department we want to configure.
4. In Add exception for folder, we browse the tree and select the folder to exempt. Only folders with the same name as the rule can be selected, because an exception is matched against the folder's full path.
5. We select Confirm, repeat for as many folders as needed, and save the dialog with Confirm.

info

The Access column of the File Manager, and the Set permissions option in the folder menu, are only visible to users who are allowed to configure restrictions. Users without those permissions never see which folders are restricted.

How exempt paths are resolved

What an exception means depends on the rule it belongs to:

Rule	The exempted folder…
Deny access	is visible to the selected departments, while every other folder with that name stays restricted.
Allow access only to	is left out of the permission, so it becomes restricted for the selected departments and stays restricted for the rest.

An exception always points at one exact folder, never at a name:

• Other folders with the same name keep behaving as the rule says.
• The exemption also covers the content of that folder, including its subfolders and files.
• A folder with the same name located inside an exempted folder is not exempted, and the rule still applies to it.

warning

Exceptions are stored as folder paths. When we rename or move the folder — or any of its parent folders — the exception stops matching and the folder goes back to what the rule says. The dialog marks those entries with a warning icon, so we can remove them and select the folder again in its new location.

info

When a user belongs to several departments, a folder is exempted only if all of their departments exempt it. Adding a department to a user never grants access that another one of their departments restricts.

Example 4: Exempting a folder from a Deny access rule

In this example the company has three applications that happen to contain a folder called Working files:

Novix/
├── Public/
│   ├── Budget 2026/
│   │   └── Working files
│   └── Sales Forecast/
│       └── Working files
└── Teams/
    └── Finance/
        └── Consolidation/
            └── Working files

We want the Sales department to stop seeing the working files of the budgeting applications, but to keep the ones of the consolidation application it collaborates on. We open the permissions dialog on any Working files folder and configure:

• Rule: Deny access
• Departments: Sales
• Exceptions for Sales: Novix/Teams/Finance/Consolidation/Working files

The result:

Folder	A user in Sales	A user in any other department
Public/Budget 2026/Working files	restricted	visible
Public/Sales Forecast/Working files	restricted	visible
Teams/Finance/Consolidation/Working files	visible	visible

The rule reaches the three folders because it matches the name, and the exception releases only the one we listed. The other departments are not part of the rule, so nothing changes for them.

Example 5: Exempting a folder from an Allow access only to rule

This example uses a different company, where several applications keep sensitive documentation in a folder called Confidential:

Contoso/
├── Public/
│   ├── Headcount Planning/
│   │   └── Confidential
│   └── Compensation Review/
│       └── Confidential
└── Teams/
    └── Legal/
        └── Litigation Tracker/
            └── Confidential

Only the People department should reach those folders. The one inside the litigation application is the exception: it is under legal hold, so it must stay out of everyone's reach, including the department that handles all the others. We configure:

• Rule: Allow access only to
• Departments: People
• Exceptions for People: Contoso/Teams/Legal/Litigation Tracker/Confidential

The result:

Folder	A user in People	A user in any other department
Public/Headcount Planning/Confidential	visible	restricted
Public/Compensation Review/Confidential	visible	restricted
Teams/Legal/Litigation Tracker/Confidential	restricted	restricted

Here the exception works the other way around than in the previous example. An Allow access only to rule grants the name to People and restricts it for every other department, so taking a folder out of the rule takes it away from People as well. The rest of the departments were restricted on that folder to begin with, so the exempted one ends up reachable by nobody — which is exactly what a legal hold needs.

tip

When in doubt about which rule to use, we can read the exception as "this folder is not part of the rule". On a Deny access rule that means the folder is not restricted; on an Allow access only to rule it means the folder is not granted.