User Role Inheritance (Parent and Child Roles)

User Role is a lookup field maintained on the Admin > Lookups > User Roles list.

See the cautions about new user roles, and additional configuration typically required, on the User Role and Permissions page.

Here is an example of adding a new user role value in the lookup:

If we selected "User" in Copy permissions from, it would do what you think. A one-time copy of the permissions in the User role — at the time of the copy — to the new User + Report Management role. Changes to either role are after the initial copy are not reflected in the other role.

Compare selecting "User" as the Parent ID. That will also copy the permissions from the User role into the new role. However, later changes to the parent User role will be reflected in the child role.

If User has the permission "Foo", so will the new role. If that permission is later removed from the User role, then the User + Report Management will not have it (it will lose the inherited permission). You could then edit User + Report Management and grant that permission.

After creating the new role using only Parent ID, the new role will only have the permission it inherits:

The new role has the 3 permissions indicated by the grayed out checkboxes, but not the others.

The grayed out checkboxes correspond to those in the parent User role:

Quiz time: If you later remove the Show Search Link permission, what will the User + Report Management role look like?

Did you guess this?

Can you now grant the User + Report Management role the Show Search Link permission? Yes.

Will that affect the parent User role in any way? No.

Breaking the Parent Child Relationship

Can you? Yes. Edit the child user role in Admin > Lookups and deselect the Parent ID.