nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Who do you give supervisor rights to?

Jolynn Uyehara

Hi All,

One of our giving officers has asked me for supervisor rights in database view so she can add her name as a fundraiser to donors records. She has supervisor rights in webview, but not database view. Which brings me to this question. Do you give supervisor rights to everyone in your advancement office? If not, how do I only give rights to do something like add herself as a fundraiser? I've been wanting to tighten the security rights but not sure where to begin.

Appreciate your help!

Aloha,

Jolynn

Find more posts tagged with

Comments

JoAnn Strommen

Hey there! @Jolynn Uyehara

No we do not give supervisor rights to everyone. I think the rights you need to add in db view is found here:

965d047bf39ffee1bac5348011997c4e-huge-im

Jolynn Uyehara

@JoAnn Strommen thank you!! Hope you are doing well!

Jolynn Uyehara

@JoAnn Strommen sorry, where can I find that? I went into the user's record and I can't locate it.

JoAnn Strommen

@Jolynn Uyehara
Db view Admin > Security and select the group that has the user in. Then Records, click options. Under constituent record types, in the privileges pane scroll almost half way down.

Dariel Dixon

@Jolynn Uyehara NO ONE!

j/k, but the number of supervisors should be very limited. I am very against giving the head of orgs/departments supervisor access because they should be going through the proper channels. You better have a good reason for needing that access. I'll listen, but I'll be secretly trying to devise a way to give you what you need without handing over the keys to the kingdom.

I know that if things go sideways, I'm going to be the one doing all the cleanup and having to deal with the aftermath.

EDIT: I'd also wonder why the fundraiser needs supervisor access in webview…

Jolynn Uyehara

@Dariel Dixon I hate to admit this, but everyone has supervisor rights. ? At least in the development office. I know it's a bad idea and I am working on tightening up security and limiting access for many. I welcome any suggestions you have. Thank you!

Dariel Dixon

@Jolynn Uyehara I would highly suggest that you talk about the rationale for this. There's more harm than good that can come from this.

Dan Snyder

@Jolynn Uyehara:
@Dariel Dixon I hate to admit this, but everyone has supervisor rights. ? At least in the development office. I know it's a bad idea and I am working on tightening up security and limiting access for many. I welcome any suggestions you have. Thank you!

To solve the issue you mentioned for your fundraiser, @JoAnn Strommen is right about where to access that information, but really all you need to do is mark the fundraiser as a solicitor on their RE constituent record. In database view that check box is on the bio1 tab. In webview it is under the “Mark as…” drop down.

Overall, I would try to categorize the office staff based on what they need to do in the database. For example, everyone might need to view gifts, but only a handful will need the ability to add or edit them. Sometimes what I do is change access to view only and then see if I get a request from anyone. If I don't then I have tightened up access and if I do, then I can better understand the various roles and processes happening in the office.

447665b2836c7cf3c7de0ba5e0a43e60-huge-im

6d2adbec19d71a45ad1c1063c894466e-huge-im

Austen Brown

@Jolynn Uyehara - @Bill Connors did a great webinar series on security a few years ago, you can find the slides on his website recourses under the “Raiser's Edge Security” heading: https://billconnors.com/resources/ Agree with Dan, it works well when database security is set up based on job role and with access to only what the person needs to be successful in their job.

In the very least, before you dive into this overhaul project, put everyone into a temp user group that still has far reaching rights but removes the right to delete. That one change will reduce your liability significantly. I'd also consider removing Config/Admin access within that first round as well.

Bring leadership into the conversation, if they lead the charge your colleagues will have no choice but to comply. In my experience, once the overhaul to rights is complete, most users won't notice or care - it's only the people that are doing things they shouldn't have been that you'll hear from.

Joe Moretti

@Jolynn Uyehara When I came aboard our organization, the first thing I do, was take supervisor's rights away from anyone who had them with the exception of two folks working under me. Other folks, I took away their rights where they were able to delete items, etc. I came aboard and just told everyone this is how the new era will be and they accepted that. Sometimes you have to just put your foot down for the sake of the database and the organization.

Jolynn Uyehara

e02b9ae3a98287b371f2f5d9dd6d71f2-huge-fu

@Dan Snyder thank you. This is so helpful. I checked the donor officer's record and in webview, there is no option to select fundraiser in her record. The “is a solicitor” box is checked in database view though. However, she's saying she is unable to add her name as a fundraiser to donor records. Shouldn't she be able to if that box is checked?

Dan Snyder

@Jolynn Uyehara
Sorry, I think I thought you were talking about assigning things like actions to themselves, but it sounds like you are talking about assigning themselves as a fundraiser in which case, @JoAnn Strommen has your answer.

Brenda Goo

Aloha @Jolynn Uyehara!
I agree with what others mentioned. Only a few admins should have supervisory access. I also agree with @Joe Moretti about removing supervisor rights from everyone. Removing supervisory rights is one of the first things I did when I took on my role, but before removing access entirely, do take the time to talk to the users and ask what areas they touch/update in NXT or database view so you can start thinking about the security roles you need to set up for the users. I have created several roles primarily defined in functional areas to meet this need, and over time, I have refined it. The Foundation team has more access than others mainly due to their NXT work. Feel free to reach out to me if you have any questions.

Brenda

Dariel Dixon

I've seen a lot of responses where people have mentioned that they have just removed admin rights from people that didn't need them or should not have had them to begin with. While I think this is a cool concept, I'd be remiss to not mention that this is not something every environment will allow. Please recognize the work environment and culture. Not all DB admins will have the backing of management, and sometimes they can be a hinderance to progress instead of being helpful. I hope you can devise a plan that is beneficial to all. Be strategic! There is a way that this can be done that reduces conflict. That said I wish you good luck and Godspeed with this change.

Emmet O'Conlon

@Jolynn Uyehara Our IT Director, my backup (under a separate, not-for-everyday-use account) within my department, and I--we all have supervisor rights.

I can also tell you we've avoided giving fundraisers the ability to add others to their portfolios in order to prevent both portfolio stuffing and stealing donors from other fundraisers. I've seen it be an issue on occasion, alas.