Quick Answer
Pinnacle Series permissions come from roles assigned directly to a user or through Inherit Permissions at the group level; they do not cascade automatically to child groups, even though group hierarchy can still extend visibility into those groups for assignment and reporting purposes.
What This Article Helps With
This article is intended for all Pinnacle Series administrators. It explains the available role types, how Inherit Permissions and group hierarchy affect what a user can do versus what they can see, and provides reference tables, common misconfiguration scenarios, and governance best practices for assigning roles.
Understanding Role Types
Each role in Pinnacle Series serves a distinct purpose. Combining roles correctly ensures the right level of access, control, and responsibility without introducing risk or unnecessary complexity.
- Content Author: Creates content but cannot publish.
- Content Publisher: Publishes approved content to shared libraries.
- Content Administrator: Oversees folder structure, metadata, and content strategy.
- Assignment Admin: Assigns content at an enterprise level.
- Assignor: Assigns content to visible users or child groups (limited visibility).
- Admin: Controls user provisioning, authentication, and platform settings.
Role Comparison Table
| Role | Content Creation | Content Publishing | Assign Learning | Library Management | Visibility Scope | Notes | Typical Use Case |
|---|---|---|---|---|---|---|---|
| Admin | ❌ | ❌ | ❌ | ✅ Platform config | All users & groups | Manages users, security, SSO, branding | IT/System Admin |
| Content Admin | ✅ All content | ✅ All libraries | ❌ | ✅ Full library control | All shared libraries | Owns templates, visibility, metadata | Head of Learning |
| Content Publisher | ✅ Shared libraries | ✅ Shared libraries | ❌ | ❌ | Assigned libraries | Manages metadata & content | Regional Trainer |
| Content Author | ✅ Drafts only | ❌ | ❌ | ❌ | Assigned draft areas | Creates & tags content only | SME or Technical Writer |
| Assignment Admin | ❌ | ❌ | ✅ All users | ❌ | Full platform | Auto-enroll & approve external learning | Global L&D Coordinator |
| Assignor | ❌ | ❌ | ✅ Visible users only | ❌ | Groups they manage/own | Use Inherit Permissions for nested visibility | Department Manager |
Permission Inheritance: What It Really Means
Inherit Permissions means a user receives the role(s) assigned to the group they belong to. It does not cascade to child groups. Group hierarchy only affects visibility for assignments and reports.
For example:
- If Content Publisher is assigned to a group and Inherit Permissions is enabled, all users in that group receive publishing rights.
- If a user is in a child group, they do not receive permissions from the parent group.
Assignors and Group Owners can see users in their child groups for assignment purposes, even though Inherit Permissions itself does not cascade permissions to those groups.
Visibility vs. Permissions
Group membership affects assignment visibility but not permissions.
- Permissions: Defined by roles assigned directly or through Inherit Permissions.
- Visibility: Defined by group hierarchy, which helps department managers assign within their teams.
Role-Based Use Cases
Select a role below to see example tasks for that role:
Content Publisher
- Edit and publish updated SOPs for regional teams.
- Manage training events in specific libraries.
- Update video transcripts in shared content.
Content Author
- Draft learning content for a new software rollout.
- Create workflow steps to be reviewed by a Content Publisher.
- Validate folder restrictions for sensitive content.
Admin
- Confirm roles match job functions (least privilege).
- Configure SSO and enforce login policies.
- Customize branding for department-level portals.
Content Administrator
- Publish required training to specific teams.
- Manage certificates and transcripts.
- Organize library access by business unit.
Assignment Admin
- Set up auto-enrollments across all departments.
- Review and approve external learning globally.
- Monitor learning completion company-wide.
Assignor
- Assign onboarding to direct reports.
- Track learning for owned teams or projects.
- View child groups if Inherit Permissions is on.
Common Permission Misconfigurations
- Too Many Admins: Increases the risk of accidental global changes or security missteps.
- Assignor Assigned Outside Their Group: Leads to assignment errors or visibility conflicts.
- Content Author Without a Content Publisher: Drafts pile up with no one to review or publish them.
- Overlapping Library Permissions: Causes confusion over content ownership and visibility.
- Inconsistent Folder Naming: Hurts searchability and makes metadata tagging less effective.
Governance Scenarios
| Scenario | Recommended Role & Setting |
|---|---|
| Local team lead needs to assign onboarding | Assignor in their group with Inherit Permissions ON |
| Content expert needs to draft a guide | Content Author in one library |
| Regional manager needs oversight only | Group Owner with no elevated role |
| Global training team needs to track compliance | Assignment Admin |
Role Decision Grid
| Need | Recommended Role |
|---|---|
| Create draft content, no publish rights | Content Author |
| Publish reviewed content into shared libraries | Content Publisher |
| Control folder visibility and metadata tagging | Content Administrator |
| Assign training across all business units | Assignment Admin |
| Assign content within a specific team or group | Assignor |
| Manage SSO, users, and settings - no content access | Admin |
Helpful Tips
- Assign only what's needed: Follow least privilege - start small and scale as needed.
- Use group-based roles: This helps with scalability, audits, and clarity.
- Separate content and assignment roles: Avoid overlapping responsibilities that cause confusion.
- Review inherited permissions regularly: Confirm they still align with actual responsibilities.
- Limit Admin rights: Reserve this role for users who configure system-wide settings.
- Define clear ownership for each role: Limit the number of Admins, use Content Administrators for visibility control, and use Assignors only within their own teams.
- Pair elevated roles with tight scoping: Always combine an elevated role with tight library or group scoping to avoid overexposure.
Common Questions
Do permissions cascade down to child groups?
No. Permissions do not cascade. Group hierarchies affect visibility for assignments and reporting only. Use Inherit Permissions at the group level to assign roles to members of that specific group.
What's the difference between an Assignor and an Assignment Admin?
An Assignor can assign learning only to users they can see, typically their own group or child groups. An Assignment Admin can assign to all users across the platform.
Can a user have multiple roles?
Yes. Users can hold multiple roles - for example, a Content Administrator may also be an Assignor. Use combined roles cautiously, since they can grant unintended access.
Can a Group Owner assign content?
Only if they are also assigned the Assignor role. Group Owner alone provides visibility over users in the group and its child groups, but not assignment capability.
How does Inherit Permissions work?
When enabled, users automatically receive the roles assigned to the group they belong to. It does not apply roles from parent or child groups - only the specific group itself.
What happens if multiple roles are assigned to the same user?
The user receives the combined access of all assigned roles. For example, a Content Publisher plus Assignor can both publish content and assign it to visible users.
How can we test permissions before rolling them out?
Use a test user account and apply roles incrementally. Log in as the test user to verify what they can see and do. Avoid testing with full Admin rights, since Admin overrides other visibility controls.
Related Articles
Explanation of Pinnacle Series Platform Permissions
Pinnacle Series Terminology for Users with Elevated Permissions