User Management as a Roles Permission

Move User Management Privileges from Global Privileges to a Role permission.

Currently, user management is permissioned via a global privilege on a user's account. When the "user accounts" privilege is set to "change," the user can view and edit all user accounts permissioned at the same mandator and lower mandators. We want this moved to a role level permission, with additional abilities to specify which level of users should be editable.

We have some users (User Type A) who need access to edit user accounts in lower mandators (User Type B), but who should not have access to user accounts in the top mandator (User Type C) nor in the same mandator (User Type A). To work around this, we have set up User Type A in the second level mandator. User Type A users can access the user accounts for User Type B as needed, but they also have access to User Type A accounts, which we do not want them to access.

In addition, User Type A needs access to batch jobs and audit logs. These permissions are only available if the user is defined at the top level mandator. We cannot set up User Type A at the top level mandator as they would have access to edit all user profiles A, B, and C.

We propose moving the User Management privileges to a role definition. This way we could set up User Type A in the top level mandator, allowing them to access batch jobs and audit logs. We could then use roles to permission these users to edit users built at lower level mandators only.