Resource Roles

Background

Custom Org Roles grant permissions across every resource of a given type in your domain. A role that can manage apps can manage all of them. That forces an all-or-nothing choice: make someone a full Admin, or give them no admin access at all.

Resource Roles are a second role type where permissions apply only to the specific resources you assign. You create the role once, then grant it to a user or group on individual apps. A team lead can manage the two apps they own and nothing else.

Related: 📄 Custom Org Roles

Why Use This

• Delegate app management to the team that owns the app. Give an engineering lead management of Figma and GitHub without granting access to every other app in Lumos.

• Reduce org admin sprawl. Move admins who only need one or two apps off org-wide roles and onto scoped ones.

• Give a team read-only visibility. Assign a view-only Resource Role to Finance for NetSuite and Expensify so they can see accounts without changing anything.

• Satisfy a least-privilege requirement. Each assignment records who has elevated access to which resource, with what permissions.

Org Roles and Resource Roles

A role is one type or the other. You choose the type when you create the role, and a role cannot be both.

Resource Roles are part of the Custom Roles system, alongside Custom Org Roles.

Prerequisites

• The Admin role, or a role with permission to manage user roles.

• Apps is the only supported resource type.

Creating a Resource Role

1. Navigate to Settings → User Roles.

2. Click "Create Role".

3. Select Resource Role as the role type.

4. Select Apps as the resource type.

5. Select the permissions the role should include. Permissions determine what a holder of the role can do on any resource the role is assigned on — for example, viewing app details and accounts, or managing the app's configuration.

6. Name the role something that describes the delegation, such as Helpdesk App Manager or App Viewer.

7. Save the role.

A saved Resource Role grants nothing on its own. It takes effect only once you assign it on a resource.

Assigning a Resource Role on an App

1. Navigate to Apps and select the app.

2. Locate the role assignment section for that app.

   1. Sometime this might be hidden. Hit columns, search for the resource role name, Unhide for it to appear in the apps table so you can assign.

3. Select the Resource Role to assign.

4. Select the users or groups to assign it to.

5. Save the assignment.

The assignment applies to that app only. To grant the same role on a second app, repeat the assignment on that app.

Assigning a Role Across Multiple Apps

Rather than assigning app by app, you can assign a Resource Role across a set of apps at once using condition-based rules — for example, every app in a given category.

Lumos evaluates conditions when you make the assignment. Apps that match the condition later are not added automatically.

Note: Bulk assignment is only available for roles with a Role Type of Resource / App. Org-level roles apply across your whole Lumos instance and don't need to be assigned per app.

1. Open the role and start a bulk assignment

1. Go to Settings → User Roles.

2. Click the role you want to assign. A details panel opens on the right showing the role's Basics (Title, Description, Role Type, Assigned Users) and its Permissions.

3. Confirm the Role Type reads Resource / App, then click Bulk Assign in the top-right corner of the panel.

The Bulk Assign dialog opens. It has three parts, top to bottom: who receives the role, which apps they receive it on, and how the assignment interacts with people already assigned.

The banner at the top of the dialog — "Users won't be assigned to apps added later" — is a reminder that this is a one-time action, not a standing rule.

2. Select the users or groups

1. Click the Select Users or Groups field.

2. Start typing a name, or scroll the list, and check each user or group you want to assign.

3. Selected entries appear as chips in the field. Remove one with the × on the chip, or clear them all with the × at the right edge of the field.

You can select more than one user or group — everyone selected receives the role on every app matched below.

3. Add a condition to select the apps

Instead of picking apps one at a time, you describe them with a condition.

1. Under Select Apps, click Add Condition. A condition row appears in the form If [attribute] is [value].

2. Open the first dropdown to choose the app attribute to match on:

   • Name — match on the app's name

   • Category — match on the app's category (for example, Accounting)

   • Status — match on the app's status

3. Use the middle dropdown to choose the comparison.

4. In the last field, enter or select the value to match — for example, choosing Category is Accounting selects every accounting app in your instance.

5. To narrow the set further, click Add Condition again and fill in another row. Use the … menu at the end of a row to remove it.

4. Review the matched apps

As you build the condition, the Matched Apps count directly beneath it updates in real time — for example, 232 Matched Apps.

Click the count (or the ⌄ arrow next to it) to expand the full list of matched apps. Each app has a checkbox, so you can scroll the list and uncheck any app that matched the condition but shouldn't be included. The count on the confirmation button updates as you do.

Tip: Always expand and skim this list before assigning. A broad condition like a category match can pull in far more apps than expected, and this list is your only chance to see exactly what's about to change.

5. Choose the assignment behavior

Some of the matched apps may already have someone assigned to this role. The Assignment Behavior dropdown at the bottom of the dialog decides what happens to them:

Add additional assignee is the default and the safest choice. Use Replace existing assignees only when you intend to remove current assignees — this cannot be undone in bulk.

6. Confirm the assignment

The confirmation button at the bottom right reflects your current selection — for example, Assign to 232 Apps. It stays disabled until you've selected at least one user or group and matched at least one app.

Click it to apply the assignment. The role is assigned to your selected users and groups on every checked app.

Because conditions are evaluated at this moment and not stored, any app that matches the condition later — a new accounting app added next month, for instance — will not pick up this assignment. Run the bulk assignment again to cover new apps.

Assigning to Groups

A Resource Role assigned to a group applies to every member of that group. Members who join the group receive the role's permissions on that resource; members who leave lose them.

Limitations

• Apps is the only supported resource type. Vendors and Access Reviews are not supported.

• A role cannot combine org-wide and resource-scoped permissions. Create one role of each type if a user needs both.

• Condition-based assignment is evaluated at assignment time, not continuously.

FAQ

Does a Resource Role replace a user's Org Role? No. The two are independent. A user can hold an Org Role and one or more Resource Roles at the same time, and their effective permissions are the combination.

What happens if I assign a Resource Role but never scope it to an app? Nothing. The role exists but grants no access until it is assigned on at least one resource.

Can I see everyone who has a Resource Role on a given app? Yes. Assignments are visible on the app itself, and role assignment activity is recorded for audit.

Can I convert an existing Org Role into a Resource Role? No. You choose the role type when you create the role. Create a new Resource Role with the permissions you need.

Do I need Custom Org Roles enabled to use Resource Roles? Resource Roles are part of the Custom Roles system.

Questions? Contact your Lumos account team or open a support ticket.