Detailed overview of rights concept Q.wiki

Modified on Thu, 2 Apr at 4:21 PM

In Q.wiki, you control what users can see and edit through rights groups. This article explains which groups exist, what rights they have, and how to assign them.

Requirement: You need Key User rights to manage rights groups.

Default rights for new users

When a new Q.wiki user is created – either manually or via Active Directory – they automatically receive the rights of a standard user. No manual assignment is needed.

You can grant additional rights to a user or restrict existing rights:

Extend rights	Restrict rights
Assignment to `KeyUserGroup`, `QMGroup`, `ResubmissionGroup`, or `ReportingGroup`	Assignment to `ReadOnlyGroup`

View and modify rights overview

As a Key User, you can use the Rights Overview to see which groups have read or write permissions in which modules.

Rights overview in Q.wiki showing read and write permissions per module

You can adjust a group's rights directly using the settings icon for each module.

Settings icon for changing module rights

Dialog for editing group rights for a module

Rights groups overview

Group	Description
Standard users	All registered users automatically belong to this group. They have all read and write rights needed for daily work with Q.wiki.
Page owners	Defined in the metadata of each page. They are responsible for the content and can perform content approval in the approval workflow.
`KeyUserGroup`	Points of contact for standard users with questions about usage. Key Users have all rights to edit and approve in the approval workflow and can access administrative tools (user management, group management, usage statistics, currency check).
`Unit-KeyUserGroup`	Like `KeyUserGroup`, but limited to a single unit. Points of contact for users in that unit.
`QMGroup`	Responsible for formal approval in the approval workflow and for the structure and formal design of Q.wiki. Moderates process recordings. See also The Seven Tasks of a Q.wiki Gardener (external).
`ReadOnlyGroup`	Users have read-only access. Typical use case: external auditors or customers who need to view documentation.
`ReportingGroup`	Members receive access to the Usage Report. Key Users are automatically part of this group.
`ResubmissionGroup`	Members can configure the resubmission functionality. Key Users are automatically part of this group.
`RoleManagementGroup`	If role management should be reserved for specific users, add them here. If the group is empty, anyone can edit roles. Details: Role Management in Q.wiki.
`UserProfileManagementGroup`	Members can edit the editable attributes of all user profiles.
`AdminGroup`	Reserved for Modell Aachen for technical setup and configuration. Can only be administered by Modell Aachen.

Functions and rights groups in the Processes module

The following table shows which functions in the Processes module are available to which rights groups.

Function	ReadOnly	Standard	Reporting	Resubmission	QM	Page Owner	Key User
Read content	✓	✓	✓	✓	✓	✓	✓
Edit content (draft / change proposal)	–	✓	✓	✓	✓	✓	✓
Upload attachments (draft / change proposal)	–	✓	✓	✓	✓	✓	✓
View usage report	–	–	✓	–	–	–	✓
Configure resubmission	–	–	–	✓	–	–	✓
Perform content approval	–	–	–	–	–	✓	✓
Perform formal approval	–	–	–	–	✓	–	✓
Delete content (published version)	–	–	–	–	–	–	✓

Assign users to a group

For step-by-step instructions, see the article Add or remove users from Q.wiki groups.

Key User role: notes and best practices

Important: Assign the Key User role carefully. We recommend training the corresponding people through the Modell Aachen Academy (external).

Key Users can perform the approval workflow without restrictions – that is, they can grant both content and formal approval. This is convenient but carries a risk: if one person approves both alone, the four-eyes principle may be violated, leading to audit deviations.

Our recommendations

For companies with up to 200 employees: a maximum of 3 Key Users
Key Users should use their approval rights only in exceptional cases, such as when a page owner is absent
Content approval typically lies with page owners
Formal approval is performed by QM (users in QMGroup, maximum 2 people)

Tips and step-by-step instructions: Perform formal approval – checklist.