# O3: Privileges Plan?

**URL:** <https://talk.openmrs.org/t/o3-privileges-plan/36038>\
**Category:** Development\
**Tags:** privileges, privacy, ohri, o3\
**Created:** [March 8, 2022, 12:02am UTC](https://talk.openmrs.org/t/o3-privileges-plan/36038 "2022-03-08T00:02:53Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![burke](https://talk.openmrs.org/user_avatar/talk.openmrs.org/burke/32/17_2.png) [@burke](https://talk.openmrs.org/u/burke)\
**Post date:** [March 9, 2022, 3:40pm UTC](https://talk.openmrs.org/t/o3-privileges-plan/36038/7 "2022-03-09T15:40:40Z")

</div>

Thanks for bringing this up, @grace. OpenMRS frontend and backend would benefit greatly from a thoughtful approach to privileging. We started with privileges & roles, where privileges controlled access to specific API methods and roles allowed the privileges to be grouped for easier assignment/management. This worked well initially, but ran into a some problems that we’re likely to exacerbate or recreate on the frontend if we’re not careful:

1. As the number of privileges grow, they become difficult for admins to manage. Roles can help assign groups of privileges, but admins can’t easily know which privileges are needed for a workflow. This led OpenMRS 2.x to a hacky approach of granting all backend privileges to users and managing feature-level privileges in the frontend, which isn’t a viable approach for OpenMRS 3.
  - If frontend features aren’t behaving as expected for a user because of a privileging issue, how does an admin troubleshoot the problem?
  - Can we come up with a way of more effectively communicating/documenting the set of privileges needed or used by a module/widget. In the past, we considered the idea of “privilege groups” as a way to define a collection of privileges needed for a feature/module, but this never got implemented.

2. Roles (groups of privileges) are often misinterpreted or created as organizational roles (“Doctor” or “Nurse”) when they are really intended to be _application_ roles (e.g., “Can write orders” or “Can view nursing dashboard”) – i.e., application roles should focus on what a user can do with the application and _not_ their job title.
  - The [UserGroup feature](https://talk.openmrs.org/t/create-a-usergroup-feature-or-organizational-roles/34229) could help us in separating organizational roles from application roles.

---

_[View the full topic](https://talk.openmrs.org/t/o3-privileges-plan/36038)._