# New permissions model: Groups
**URL:** https://community.fibery.io/t/new-permissions-model-groups/1713
**Category:** News & Announcements
**Created:** [June 21, 2021, 1:17pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713 "2021-06-21T13:17:18Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@mdubakov](https://community.fibery.io/u/mdubakov)
#### Post date: [June 21, 2021, 1:17pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/1 "2021-06-21T13:17:18Z")
We are releasing Groups today, here is the in-depth article on how we approaching access management in Fibery
> **[Group permissions that blend into collaboration software](https://fibery.io/blog/group-permissions/)**
>
> In most products, you'll find permissions on the outskirts, disconnected from the rest of the data — but not in Fibery.
---
### Author:  [@Oshyan](https://community.fibery.io/u/Oshyan)
#### Post date: [June 21, 2021, 5:20pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/2 "2021-06-21T17:20:28Z")
While I don’t really have use myself for such powerful permission management, I do love that you are taking this approach! It is very much in line with the Fibery philosophy thus far, and continues to demonstrate (to me, at least) the benefits of that approach.
That said, it does seem of most benefit to larger orgs. That’s where the money for Fibery is, no doubt. So I get the priority here. But I think “dashboards”, embeds, and a number of other things will also benefit them, and _everyone_, so I hope to see them focused next/soon. 😃
---
### Author:  [@Matt\_Blais](https://community.fibery.io/u/Matt_Blais)
#### Post date: [June 21, 2021, 5:50pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/3 "2021-06-21T17:50:24Z")
Love it! 💖
Will it be possible to apply this approach not only to entire apps, but also to entities, based on field/relation values of the entity?
E.g., I will have a “Customer” Type, and a “Customers” class of Users, where each Customer User is related to a specific Customer entity. I want to limit the “Customers” users to only access entities (e.g. Project and Task entities) that are related to a the same Customer.
---
### Author:  [@mdubakov](https://community.fibery.io/u/mdubakov)
#### Post date: [June 21, 2021, 5:53pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/4 "2021-06-21T17:53:26Z")
> [@Matt\_Blais](#):
>
> E.g., I want to limit a particular Customer’s access to only those entities that are related to that customer.
Yes, this is exactly what we will implement in Per-entity permissions. However, it’s hard to forecast when it will be done, most likely it will take 3+ months. But what we can promise is that we will have a team dedicated to permissions this this problem will be solved.
---
### Author:  [@Matt\_Blais](https://community.fibery.io/u/Matt_Blais)
#### Post date: [June 21, 2021, 6:08pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/5 "2021-06-21T18:08:23Z")
100 Internet Points™ for doing it right 🏆
---
### Author:  [@Chr1sG](https://community.fibery.io/u/Chr1sG)
#### Post date: [June 21, 2021, 8:07pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/6 "2021-06-21T20:07:04Z")
> [@mdubakov](#):
>
> We are releasing Groups today
👏
Is it possible to implement a dynamic permissions system?
I currently have defined a Role type, and I use a ‘helper’ type (Assignment) that allows users to be assigned to a role with a start date and an end date, i.e.
Role 1:n Assignment
User 1:n Assignment
I use a formula in the Assignment type to determine if it is current (start \< today \< end) and a formula in the Role type to filter for all related Assignments that are current. I can then have a lookup in the Role type to find all Users who are currently assigned.
This means that the Role type does have a relationship to the User type, but it is a calculated, read-only relationship, and I can’t enable the ‘Use Roles to manage access’.
Any suggestions?
---
### Author:  [@cannibalflea](https://community.fibery.io/u/cannibalflea)
#### Post date: [June 22, 2021, 6:40am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/7 "2021-06-22T06:40:29Z")
This looks very promising and seems to be a great approach. In light of the approach and some of the examples mentioned with use nested hierarchy, I was wondering if more thought has been given to [nested hierarchies](https://community.fibery.io/t/representing-recursive-relations/). I think those are somewhat important to this feature, especially if you are able to handle inheritance from parents (which might be the solution to an entity having two parents, ie one is the actual parent, the other inherited)
---
### Author:  [@antoniokov](https://community.fibery.io/u/antoniokov)
#### Post date: [June 22, 2021, 9:42am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/8 "2021-06-22T09:42:41Z")
> [@Chr1sG](#):
>
> This means that the Role type does have a relationship to the User type, but it is a calculated, read-only relationship, and I can’t enable the ‘Use Roles to manage access’.
That’s quite an interesting case and (funny enough) we’ve just discussed a similar one today.
So far the workaround is to use automation rules + relation instead of the lookup, which is less reliable but unlocks Groups.
We’ll try to brainstorm a native solution though.
---
### Author:  [@antoniokov](https://community.fibery.io/u/antoniokov)
#### Post date: [June 22, 2021, 9:44am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/9 "2021-06-22T09:44:22Z")
> [@cannibalflea](#):
>
> I was wondering if more thought has been given to [nested hierarchies](https://community.fibery.io/t/representing-recursive-relations/)
Could you please provide an example in the context of group permissions?
Are you thinking about Department → Team group membership inheritance or Project → Task access inheritance?
---
### Author:  [@Chr1sG](https://community.fibery.io/u/Chr1sG)
#### Post date: [June 22, 2021, 9:59am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/10 "2021-06-22T09:59:30Z")
Yes, I did think of either using automations or auto-relations to achieve the functionality I needed, but I couldn’t fathom a way of doing it.
The automations can’t be set to trigger when a collections field is updated, and I didn’t manage to find a rule that would allow to auto-relate Roles and Users…
What did you have in mind for a workaround?
---
### Author:  [@antoniokov](https://community.fibery.io/u/antoniokov)
#### Post date: [June 22, 2021, 5:18pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/11 "2021-06-22T17:18:38Z")
> [@Chr1sG](#):
>
> What did you have in mind for a workaround?
Let’s take a pause with workarounds for a couple of days: we might have a highly experimental but native solution 🤞.
I’ll get back to you via Intercom, once we are ready.
If someone else is interested in using calculated Users collection as a Group, please ping us via Intercom. If experiment succeeds, we’ll make the feature public but so far we’d like to keep it secret 🙂
---
### Author:  [@Chr1sG](https://community.fibery.io/u/Chr1sG)
#### Post date: [June 22, 2021, 6:24pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/12 "2021-06-22T18:24:43Z")
👍
Highly experimental is fine 🙂
---
### Author:  [@cannibalflea](https://community.fibery.io/u/cannibalflea)
#### Post date: [June 22, 2021, 10:25pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/13 "2021-06-22T22:25:42Z")
> [@antoniokov](#):
>
> Are you thinking about Department → Team group membership inheritance or Project → Task access inheritance?
I was thinking more along the line of department to team inheritance.
The reason I linked to the nested relationship thread was that for sufficiently complex organizations, they may have an arbitrary/varied level of nesting so the “organizational unit” concept rather than company/department/team model might be needed. It would be great to be able assign broad permissions at higher levels and have those cascade down and be supplemented by other more specific permissions.
---
### Author:  [@JMaynier](https://community.fibery.io/u/JMaynier)
#### Post date: [June 25, 2021, 4:25am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/14 "2021-06-25T04:25:34Z")
Hi @antoniokov, I have the same need.
I have an Employee type that have multiples fields (address, phone number, start date, etc). Each Employee is linked to several types:
- User type (one-to-one relationship): if the Employee is User
- 1:1 Meetings type (one to many)
- Team type: hierarchical team
- Squad: for cross functional teams
etc
I would like to use Team and Squad for permissions, but I cannot since they are linked to Employee and not User directly. So a way to “propagate” the connection to User would be helpful.
Alternatively, I wonder now if I need the Employee type. I thought that it was not possible to add fields to User (but I was wrong). And for the Employee that will not be Fibery users (or at least not initially) éi could still create them as User and deactivate them.
Do you recommend to use User and customize it instead of my Employee type?
In any case we will still need to have a solution to allow types that are indirectly linked to Users to be used as group. The simples example is having a the following types and relationship
Department → Team → User
It is natural to be able to assign permissions at the Department level.
---
### Author:  [@Chr1sG](https://community.fibery.io/u/Chr1sG)
#### Post date: [June 25, 2021, 7:09am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/15 "2021-06-25T07:09:21Z")
> [@JMaynier](#):
>
> could still create them as User and deactivate them
I’m not sure that is a solution, since you can’t really do anything with deactivated users (link to them, assign to them, etc)
---
### Author:  [@antoniokov](https://community.fibery.io/u/antoniokov)
#### Post date: [June 27, 2021, 10:44am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/16 "2021-06-27T10:44:10Z")
> [@cannibalflea](#):
>
> The reason I linked to the nested relationship thread was that for sufficiently complex organizations, they may have an arbitrary/varied level of nesting so the “organizational unit” concept rather than company/department/team model might be needed. It would be great to be able assign broad permissions at higher levels and have those cascade down and be supplemented by other more specific permissions.
Got you, makes a ton of sense.
So here is a way to model this in Fibery:
1. Create `Unit` Type with one-to-many relation to itself (Parent Unit → Units).
2. Visualize Units via a Hierarchical List to build the nested hierarchy.
3. Add a many-to-many relation from `Unit` to `User` and mark it as group membership.
4. Link Users directly to their lowest level Units.
5. Manage App access via Units.
6. 🙏 Automatically inherit access: if a User is a member of Unit `iOS Developers` and either parent Unit `Mobile Developers` or its parent `Developers` have Editor access to an App, then the User should have the Editor access as well.
At the moment, we are missing the #6.
Here is a question: do you have people that do not belong to any lowest-level Unit (like `iOS Developers` or `Android Developers`) and are assigned directly to some higher-level Unit (ex. `Developers`)? If yes, who are these folks?
---
### Author:  [@antoniokov](https://community.fibery.io/u/antoniokov)
#### Post date: [June 27, 2021, 11:30am UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/17 "2021-06-27T11:30:09Z")
> [@JMaynier](#):
>
> Do you recommend to use User and customize it instead of my Employee type?
I don’t — at least at the moment. As @Chr1sG pointed out, deactivated Users aren’t designed for this use case. There is a chance we’ll change that but not sure about the ETA.
Instead, let’s try the same experimental solution I’ve mentioned above. I’ll come knocking in Intercom (;
---
### Author:  [@mdubakov](https://community.fibery.io/u/mdubakov)
#### Post date: [July 22, 2021, 1:49pm UTC](https://community.fibery.io/t/new-permissions-model-groups/1713/18 "2021-07-22T13:49:30Z")
Implemented in latest release [CHANGELOG: July 22 / Action Buttons in Table View, Improvements and bug fixes](https://community.fibery.io/t/changelog-july-22-action-buttons-in-table-view-improvements-and-bug-fixes/1829)