Roles and permissions

How the three roles in Bonita Process Designer work, the rights each one grants, and how role and group membership combine to isolate diagrams and folders.

Bonita Process Designer controls access with two layers that always apply together:

  • a global role assigned to each user — Admin, Creator, or Reader — that decides what kind of action you may perform;

  • a group-scoped access boundary that decides which diagrams and folders you may see and act on.

Both layers are enforced on the server, so the rules below hold no matter what the interface shows. The role set is fixed: there are no custom roles and no per-diagram role overrides.

The three roles

Role What it can do

Admin

Full access across every group, plus management of users, groups, labels, application settings, the installation, the AI quota, and the license, and the diagnostic archive for Support. An Admin sees and changes every diagram and every folder regardless of group membership.

Creator

Everything a Reader (below) can do, plus create, edit, move and delete diagrams and folders within the groups they belong to. A Creator can edit diagrams in real time alongside others, choose the process a Call Activity calls, take snapshots and restore versions, and use AI generation.

Reader

Read and annotate. A Reader views diagrams, folders and comments, opens called processes, exports, prints, runs a simulation, marks favorites, and posts comments — anything that does not change a diagram or where it is filed. A Reader cannot create, edit, move, or delete diagrams or folders, and cannot use AI generation.
A Creator’s edit rights are role-based, not ownership-based. Any Creator who belongs to a diagram’s group can edit, move or delete it — the person who created it has no special privilege. Conversely, a Reader who once created a diagram (for example, before being downgraded) still cannot edit it.

Rights matrix

The following matrix lists every capability against the three roles. Each "Yes" for an action on a diagram or a folder is additionally subject to the group boundary described below (an Admin is exempt and spans all groups).

Capability Admin Creator Reader

Diagrams

List, search and open diagrams

Yes

Yes

Yes

Create a diagram

Yes

Yes

No

Edit and save a diagram

Yes

Yes

No

Edit the labels of a diagram

Yes

Yes

No

Delete a diagram

Yes

Yes

No

Mark a diagram as a favorite

Yes

Yes

Yes

Folders and filing

Open folders and browse the Tree view

Yes

Yes

Yes

Create, rename, move and delete folders

Yes

Yes

No

Create a folder that has no group

Yes

No

No

File or move a diagram: into a folder, under another diagram, or back to Home

Yes

Yes

No

In the editor

Open a called process from its Call Activity

Yes

Yes

Yes

Set, change or clear the called process of a Call Activity

Yes

Yes

No

Export (PNG, JSON, BPMN, BPMN+) and print

Yes

Yes

Yes

Import a file, into the open diagram or as a new diagram

Yes

Yes

No

Change the status of Import Logs entries

Yes

Yes

No

Run a simulation

Yes

Yes

Yes

Post a comment

Yes

Yes

Yes

Delete a comment

Own only

Own only

Own only

View and download versions

Yes

Yes

Yes

Take a snapshot, restore a version as a new diagram

Yes

Yes

No

AI generate / modify / analyze

Yes

Yes

No

Attach or remove marketplace connectors and actor filters

Yes

Yes

No

Change your own display name, avatar and language

Yes

Yes

Yes

Administration

Manage labels

Yes

No

No

Manage users and groups

Yes

No

No

Manage settings, installation, license and AI quota

Yes

No

No

Download the diagnostic archive (Support tab)

Yes

No

No

Use the management endpoints (/actuator), for example to change a log level

Yes

No

No

Comments are an exception to the read/write split: any role can post a comment, because a comment is treated as an annotation rather than a change to the diagram model. Every user, Admins included, can delete only the comments they wrote. Known limitation: once the account of a comment’s author is deleted, nobody can delete that comment any more; it is removed with its diagram.

Moving a diagram also moves the diagrams filed under it, and a move is refused when the destination is in another group, for Admins too. See Restrictions.

The called process of a Call Activity is part of the diagram, so choosing it is an edit: Readers can follow the call, but not set it. See Call other processes.

Editing is collaborative and server-authoritative: there is no hard lock to acquire or release. Several people who may edit a diagram can open it at the same time and their changes are merged in real time, with an advisory indicator showing who is working on an element. While another user’s AI request is changing a diagram, the others cannot change it until the request is over. For details, see Collaborate in real time.

Group scoping and data isolation

A diagram, and a folder, can belong to a group. Groups are the data-isolation boundary in Bonita Process Designer: a non-Admin user only ever sees and works with the diagrams and folders of the groups they are a member of. The boundary is applied to the listings themselves, so a non-member never even sees that another group’s diagram or folder exists.

The access rule is:

  • Admin sees and changes every diagram and folder, in any group or none.

  • For a group-scoped diagram or folder, a non-Admin user must be a member of its group to read or change it. Non-members are fully isolated: it is hidden from their home page, and any direct attempt to open it (or a diagram’s comments and version history) is refused.

  • A diagram with no group is visible and editable only by the user who created it (and by any Admin). It is never exposed to other groups.

  • A folder with no group is visible to, and managed by, Admins only. Only an Admin can create one.

When a non-Admin user creates a diagram or a top-level folder, they must place it in a group they belong to; a folder created inside another folder takes that folder’s group. An Admin may create a diagram or a folder in any group, or in none.

A folder only holds diagrams and folders of its own group, and a diagram can only be filed under a diagram of its own group. A move between groups is refused, whatever the role.

For how to create groups and manage their membership, and what happens to diagrams and folders when a group is deleted, see Manage groups.

How role and group membership combine

The two layers are additive — group membership never grants a permission the role forbids, and the role never overrides group isolation:

  • A Reader who is a member of a group can see that group’s diagrams and folders and comment on the diagrams, but still cannot edit, move or delete them.

  • A Creator can edit, move and delete diagrams and folders, but only within groups they belong to. They cannot reach a diagram or folder in a group they are not a member of.

  • An Admin is implicitly privileged everywhere and is never limited by group membership.

A worked example: suppose a Creator belongs to the "Finance" group but not "HR". They can edit any Finance diagram, file it in a Finance folder, comment on it, and run AI generation against it. The same user cannot see HR diagrams or folders at all — those are excluded from their home page and any direct link to them is refused. An Admin, by contrast, sees and edits both.

If a user reports that a diagram "disappeared" or that they get an access error opening a link, the most common cause is group membership: check the diagram’s group and the user’s membership in Manage groups. A diagram filed under another diagram is not shown as a card: it is in the Tree view, and search finds it.

Read-only experience for a Reader

On the home page, a Reader does not see Create New Diagram and New folder, the card menu only offers Open, and the Tree view is read-only: no checkboxes, row actions, or drag and drop.

When a Reader opens a diagram, the editor presents a read-only surface: a Read-Only Mode banner is shown, the element palette and the inspector are hidden, and edit actions (Save diagram, Undo, Redo, Open file) are removed. Export, including BPMN+, and Print stay available, the canvas is frozen, and the read-only description and the comment box remain usable. The Import Logs tab and the AI panel are not shown to a Reader. A Reader can open a called process from the button on its Call Activity, in a document tab, but cannot choose the called process, since the inspector is hidden.

A Creator or Admin always opens a diagram with full editing rights, even when other people are editing it at the same time — concurrent edits are merged in real time rather than blocked.

This is a convenience layer on top of the server-side checks: the server remains the authority and rejects any forbidden action regardless of what the interface allows.

What is not configurable

The following are intentionally fixed in this release:

  • Custom roles — the Admin / Creator / Reader set cannot be extended.

  • Per-diagram, per-folder or per-group role overrides — a user has one global role.

  • Group-level roles (such as an "owner" within a group) — group membership is binary: you are either a member or you are not.

Related pages