[WIP - DRAFT] Content-level permission requirements in Libraries
For the Libraries MVP, we built a barebones roles and permissioning system. Details here. The tl;dr is that access controls (view access and write access) are set at the Library level. Now that Libraries have evolved, we are collecting user input that indicates a need for a more granular permissioning framework at the content level (components, units, subsections, sections).
User data
Users have different reasons for needing more granular permissions in Libraries, but they all point toward a generalized requirement: Permissions to read or write must be set at the content level.
In general, organizations seem to want to enable teams with multiple instructional designs, authors and faculty to work with content in a library, but they need to protect and preserve content integrity by ensuring library users are not over-permissioned and potentially making changes to content they don’t “own” (“own” being defined in the context of any particular organizational approach to managing teams of instructional designers and faculty). This aligns with one of our guiding principles and value propositions for Libraries, that Libraries are designed to hold large amounts of content with robust content management tools to support them.
Users need to set permissions at the content level in order to:
Permit a library author to edit and reuse some content but not other content, due to content licensing and royalty restrictions;
Control/manage large faculty teams (10+ members) who each need to review and edit parts of a course but not all of a course;
Create scaffolded training pathways for new instructional designers;
Enable individual instructional designers to “own” their own content without risk of other team members unintentionally or intentionally changing it.
“Some of my instructional designers are stronger than others, and I can see that, especially when they are beginning, you don’t want them to accidentally or intentionally edit something that shouldn’t be edited. One designer isn’t going to want another designer changing content they don’t own.”
“I work with a team of 10 faculty members and I can’t fathom giving all 10 of them access to all the content [in a library]. I need to restrict them to a particular set of content, maybe a collection?, and say: this is yours, you can edit it, but others cannot.”
“One course has 13 faculty members building it and they each need to be able to review, give feedback and edit [content created by the instructional designers], and I need to keep them focused and zero-ed in on just their content.”
“We have situations where some folks are permitted to edit and reuse content and other folks are not, due to copyright reasons.”
User stories
As a library administrator, I need to be able to assign write permissions for library authors on individual pieces of content (components, units, subsections, sections).
I’d like an option to set permissions for a user on individual pieces of content in bulk, for example by giving a user write access on all the content in a collection, or on all the content with a particular tag.
Scope:
Admins can assign write permissions for a library user on an individual component, unit, subsection, or section.
Admins can assign write permissions for a library user on a set of content (approach TBD - via a collection? A tag selection? Bulk select?)
Admins can still assign view or write permissions at a library level. If a user has access permissions set at the content level, those permissions override any library-level settings.
Features and Requirements:
Enhancements to the “Library Team” modal:
A workflow that enables admins to drill down into individual user permissions and assign write access to users at the content level
Enhancements to the content sidebar “details” tab:
A list of all users who have write access to a piece of content
UX/UI considerations:
Is there a way to leverage the library picker modals here? Eg, from the Library Team modal, an admin drills down into a user’s permissions and can add write permissions to content using the library picker modal to choose the content or collection
Limitations, constraints, other considerations:
The ongoing discovery around the MVP RBAC admin console
Open questions:
Do we need a permission for enabling content reuse?
Ulmo or Verawood?