Problem Definition

User Story

As a process owner
I want to give basic read-only access to certain Optimize data
So that my customers and stakeholders can track their performance

Use Cases

• (MH) Read-only users can explore the data presented in a dashboard
• (MH) Read-only users cannot make any changes that affect other users (persist between sessions)
• (MH) Read-only users cannot create Collections
• (MH) Read-only users cannot share anything
• (SH) Read-only users can inspect process KPIs
• (SH) Read-only users can download raw data reports as CSV
• (SH) Read-only users have a limited UI without distracting buttons to functionality they can't access

PM Notes (Customer requests, context, assumptions)

• Shared or embedded dashboards don't meet their needs because filters aren't interactive and CSVs cannot be downloaded
  • Other customers are asking for additional restrictions for CSVs. Data export  is a major security risk for CIOs/CISOs
  • Filterable shared dashboards wouldn't likely introduce a security risk because they have to be enabled by a write-enabled user in Optimize.
• Collection-based access control doesn't meet their needs because any Optimize users can create Collections
  • Stakeholders benefit from a streamlined interface - "Users without any write roles should not create or modify collections, dashboards or widgets and they shouldn't even see the option (button) for that." SUPPORT-12794
• "We could truly use Optimize as our reporting tool. Currently, we cannot really do so because of this." SUPPORT-12794
• "We currently only allow a very small group of users in Optimize because not all employees should compile reports and we don't want to release every single process in Camunda. So we are waiting for the feature to make Optimize available to a larger audience. It would be great if it would work out in the course of the year." SUPPORT-6779
• "We want to set up a group that can create collections and then publish them to targeted users. It works so far, but it bothers me that this user (who only has read permissions) can share the collection so that you can also view it without an Optimize/Camunda account." SUPPORT-6779
• "Security and more granular control over who has access to sensitive information is key to this industry. this would have importance not only to this customer, but to others within the same industries (which I believe is one of Camunda's strongest verticals)" Josh Roche, CSM on SUPPORT-7940
• Felix previously proposed a solution on OPT-2828 that involved global permissions at the Optimize application level beyond simple R/W access
• "The aim or condition of the [feature request] is that certain users (groups) [are] unable to generate reports, unable to share reports, [and] can only see certain reports" SUPPORT-6524

Solution Definition

Solution Ideas

Design Notes (Videos, mockups, guidance)

User Scenario

GIVEN
(MH/SH/NTH) WHEN
(MH/SH/NTH) THEN

Metrics (if applicable)

• Number of read-only users that view an Optimize page