Should you set categories from a template?

[Marc]

I'm a bit confused when it comes to setting category permissions. I
understand that it is best to set features, then design templates, then
design groups and set the group global permissions directly from the template
(i.e., the Project Managers group reads in permissions from the Project
Managers template). Categories are more confusing.

For example, the delivered My Projects category has the Project Managers,
Resource Managers, and Team Leads groups assigned to it. When the category
permissions are set in the Categories view, is each group highlighted in the
Users and Groups with Permissions box and then permissions are read in by
selecting the associated template and clicking Set Permissions with Template
(i.e., highlight Resource Managers, choose Resource Managers from the drop
down below the permissions box, and click Set Permissions from Template)? If
so, this means that the Allow/Deny checkboxes will change each time a
different group is selected in the Users and Groups with permissions box.
Appendix C of the Project 2003 Administrators Guide provides category
defaults, but are these defaults for all groups within a category or only one?

 

[Reid McTaggart]

Lots of people are confused in this area. Here are some pointers:

Security templates are a convenience; you can use them or not. The security
templates that come with the product offer some typical settings. You can
create your own templates if you like, and use them to return to your
"standard" setup after experimenting with directly setting permissions. As
you probably realize, you can use any template you like to set permissions
for any group/category you like.

I often use the standard templates as a starting point, and then modify the
settings directly to get the exact security scheme I want. Other times, it
is pointless to use a template because the settings are so basic, such as
when the purpose of the category is solely to deny permission to open certain
projects.

You wrote, "If so, this means that the Allow/Deny checkboxes will change
each time a different group is selected in the Users and Groups with
permissions box."

You are correct, and understanding your observation is key to understanding
the security model. Category-related permissions are set separately for each
group in the category. That gives the security model great flexibility. A
LOT of users - and even some consultants - don't realize this, and they get
very confused when permissions they set seem to change.

 

[Marc]

Thanks, Reid. That helps.

Lots of people are confused in this area. Here are some pointers:

Security templates are a convenience; you can use them or not. The security
templates that come with the product offer some typical settings. You can
create your own templates if you like, and use them to return to your
"standard" setup after experimenting with directly setting permissions. As
you probably realize, you can use any template you like to set permissions
for any group/category you like.

I often use the standard templates as a starting point, and then modify the
settings directly to get the exact security scheme I want. Other times, it
is pointless to use a template because the settings are so basic, such as
when the purpose of the category is solely to deny permission to open certain
projects.

You wrote, "If so, this means that the Allow/Deny checkboxes will change
each time a different group is selected in the Users and Groups with
permissions box."

You are correct, and understanding your observation is key to understanding
the security model. Category-related permissions are set separately for each
group in the category. That gives the security model great flexibility. A
LOT of users - and even some consultants - don't realize this, and they get
very confused when permissions they set seem to change.