Custom Permissions

Custom Permissions

This guide documents all custom permissions in the Suger Salesforce App. Custom permissions control feature access and UI visibility for offers, referrals, and administrative functions.

Overview

Suger uses Salesforce Custom Permissions to control granular access to specific features within the app. These permissions are assigned to users through Permission Sets (see Permission Sets).

Custom permissions differ from Permission Sets in that they:

• Control specific features and actions (not object access)
• Enable/disable UI elements like buttons and menu items
• Follow a hierarchical logic where generic permissions override platform-specific ones

Permission Hierarchy

The Suger permission model uses a hierarchical structure where generic permissions override platform-specific permissions:

GENERIC (applies to all platforms)
├─ Create_Offer ────────► Can create offers for ANY platform
├─ Read_Offer ──────────► Can read offers from ANY platform
├─ Create_Referral ─────► Can create referrals for ANY platform
└─ Read_Referral ───────► Can read referrals from ANY platform

PLATFORM-SPECIFIC (limited to one platform)
├─ AWS
│   ├─ Write_AWS_Offer
│   ├─ Read_AWS_Offer
│   ├─ Write_AWS_Referral
│   └─ Read_AWS_Referral
├─ Azure
│   ├─ Write_Azure_Offer
│   ├─ Read_Azure_Offer
│   ├─ Write_Azure_Referral
│   └─ Read_Azure_Referral
├─ GCP
│   ├─ Write_GCP_Offer
│   ├─ Read_GCP_Offer
│   ├─ Write_GCP_Referral
│   └─ Read_GCP_Referral
└─ Snowflake
    ├─ Write_SNOWFLAKE_Offer
    └─ Read_SNOWFLAKE_Offer

Offer Permissions

Generic Offer Permissions

Platform-Specific Write Permissions

These permissions allow creating and modifying offers for a specific cloud platform only.

Platform-Specific Read Permissions

These permissions allow viewing offers for a specific cloud platform only.

Referral (Co-Sell) Permissions

Generic Referral Permissions

Platform-Specific Write Permissions

Platform-Specific Read Permissions

Approval Permissions

These permissions control access to approval workflows for offers and co-sell referrals.

Contact Management Permissions

These permissions control the ability to manage contacts on offer records.

Administrative Permissions

Permission Checking Logic

The Suger app uses the following logic to determine user access:

For Offer Creation

1. Check if user has Create_Offer → Grant access to all platforms
2. If not, check platform-specific permission (e.g., Write_AWS_Offer)
3. If neither, access is denied

For Offer Reading

1. Check if user has Create_Offer → Writers can read (grant access)
2. If not, check if user has Read_Offer → Grant access to all platforms
3. If not, check platform-specific permission (e.g., Read_AWS_Offer)
4. If none, access is denied

For Product Filtering

When creating offers, the product list is filtered based on the user’s write permissions:

• If user has Create_Offer → Show products for all platforms
• If user has only Write_AWS_Offer → Show only AWS products
• Multiple platform permissions combine (e.g., Write_AWS_Offer + Write_GCP_Offer shows both)

UI Elements Controlled by Permissions

Tab Visibility

Action Buttons

Permission Set Assignments

The following table shows which custom permissions are included in each permission set:

Suger User (Full Access)

The Suger User permission set grants access to ALL custom permissions across all platforms:

Marketplace Permission Sets

Co-Sell Permission Sets

Administrative Permission Sets

Best Practices

Principle of Least Privilege

Assign the most restrictive permission set that meets the user’s needs:

• For human users who need full access to the Suger app, use Suger_User
• For users who only work with one cloud platform, use platform-specific permission sets
• Reserve Suger_Integrator for integration/API users only (not human users)

Permission Set Groups

Consider creating Permission Set Groups to combine multiple permissions:

• AWS Power User: Suger_User_Marketplace_AWS + Suger_User_Cosell_AWS
• Multi-Cloud Viewer: Suger_User_Marketplace_Read + Suger_User_Cosell_Read

Testing Permissions

Before deploying permission changes to production:

1. Create a test user with the target permission set
2. Verify tab visibility matches expectations
3. Confirm action buttons appear/hide correctly
4. Test actual CRUD operations to verify object-level access