Role

Go up to Terms and Definitions

A Role is a named set of responsibilities, permissions, and expected behaviors assignable to an Actor within a defined context.

An Actor can include:

• A person
• A User
• An Organization
• An organizational unit
• A system
• A service
• A Node
• Another participant capable of performing assigned responsibilities

A Role can establish:

• Responsibilities
• Permitted actions
• Prohibited actions
• Required actions
• Decision rights
• Access permissions
• Approval authority
• Accountability
• Separation-of-duty constraints
• Qualification requirements
• Applicable Policies
• Applicable Governance Policies

A Role can identify:

• Its identity
• Its name
• Its description
• Its responsibilities
• Its permissions
• Its constraints
• Its applicable context
• Its applicable Governance Domains
• Its assigning authority
• Its eligible Actor types
• Its qualification requirements
• Its incompatible Roles
• Its delegation rules
• Its effective time
• Its expiration time
• Its Provenance
• Its Traceability

named set of responsibilities, permissions, and expected behaviors assignable to an Actor within a defined context

Adapted from:

• DIDO Reference Architecture
• DIDO Reference Implementation Conceptual Model
• DIDO-TE draft Requirements Register

A Role differs from an Actor:

• A Role specifies responsibilities, permissions, and expected behaviors
• An Actor performs or assumes the Role

A Role differs from a User:

• A Role identifies responsibilities, permissions, and expected behaviors
• A User identifies a person, Organization, or system that interacts with or uses a system, service, or Resource

A User can act in multiple Roles. Multiple Users can act in the same Role.

A Role differs from an organizational position:

• A Role specifies responsibilities and behavior within a context
• An organizational position identifies a place within an organizational structure

An organizational position can receive one or more Roles.

Assigning a Role to an Actor does not necessarily grant every permission associated with the Role. The assignment must satisfy the applicable authorization, qualification, scope, time, and Governance Policy constraints.

A Role can apply at multiple architectural levels. For example:

• A person can perform a Test Operator Role
• A Node can perform a Validation Role
• An Organization can perform a Governing Authority Role
• A service can perform an Evidence Collection Role

A Role does not determine its implementation. Different Actors can realize the same Role through different technologies, processes, or organizational arrangements.

A Role assignment should preserve:

• The assigned Actor
• The assigned Role
• The assigning Authority
• The applicable scope
• The effective time
• The expiration time
• The applicable constraints
• The applicable Provenance
• The applicable Traceability

DIDO-TE defines the following Roles:

• Test Administrator
• Test Designer
• Test Operator
• Evaluator
• Evidence Custodian
• Baseline Manager
• Approval Authority

A User acting in the Test Operator Role can initiate an approved Test Run.

A User acting in the Evaluator Role can review the resulting Test Results and supporting Evidence.

A User acting in the Approval Authority Role can make the applicable Validation Decision.

The Roles remain distinct even when one User receives more than one Role, subject to the applicable separation-of-duty constraints.