Configure access for a new user

This quickstart shows how to create a new Finsaku user with the appropriate access level.

The scenario separates application entry from lending. Maya Collins is a customer-service representative who can create, update, and submit applications but cannot approve or lend them. Daniel Reed is a loan officer who can approve an application and use Lend to create the loan and contract.

For: Access administrators creating operational users and role groups.
Requires: User, permission-group, saved-query, and impersonation administration permissions.
Available when: The tenant uses password-based users and has a Workspace loan-application entry point.
Before you begin: Identify the lending product, application saved query, affiliation requirements, and separation-of-duties boundary.
Expected result: Each synthetic user can complete their assigned part of the application workflow and cannot cross the configured boundary.

Quickstart point	This run
Estimated time	30–45 minutes.
Starting state	No matching operational groups or synthetic users exist.
Finish state	Two active groups and users are in place, and their effective access has been observed with impersonation or direct sign-in.

Workflow

Permission groupsTwo roles created

Add User

Synthetic usersMaya and Daniel assigned

Impersonate

Application entryMaya's boundary observed

Switch user

Approval and lendingDaniel's boundary observed

Create the two permission groups

Open Administration → Add Group for each role. Enter the Name, add the starting permissions below, and select Add.

Group	Task-level permissions	Do not add
Customer service representative	Find Persons, Find All Persons, Read Person, Init Quote, Save Quote, Read Quote, Find Quote, Generate Payment Schedule, Submit Quote, and List Internal Queries	Approve Quote, Reject Quote, Lend Quote
Loan officer	The customer-service set plus Approve Quote and Lend Quote	Broad payment, export, user-administration, group-administration, or impersonation permissions unless the job requires them

The permission catalogue uses Quote for a loan application. These are task-focused starting sets, not a universal security policy. Use the task-based permission recipes for the detailed catalogue and optional document, note, message, assignment, label, and history permissions.

Permission names alone do not make the Workspace entry points visible:

Open the internal saved query used to list applications and confirm its Location, visibility, and required permission.
Ensure both groups have that query's required permission as well as List Internal Queries.
Confirm the selected product is active and available from New Application.
If an affiliation restricts visibility, configure and check that scope separately.

Create Maya Collins and Daniel Reed

Open Administration → Add User and create the following synthetic accounts. Use secure temporary passwords and do not include them in screenshots or documentation.

User	Login	Group
Maya Collins	`maya.collins@finsaku.com`	Customer service representative
Daniel Reed	`daniel.reed@finsaku.com`	Loan officer

For each account:

enter the synthetic identity and unique Email;
select an Affiliation only when the scenario requires partner-restricted access;
select the one intended Group;
enter User password and Confirm user password;
select Add, then reopen the user and confirm Status, Groups, and User locale.

Filtered Finsaku Users list showing the active synthetic accounts Maya Collins and Daniel Reed — The filtered **Users** list shows the two active synthetic accounts used in this scenario. Reopen each user to confirm its assigned group.

Use one account per individual. Users covers password rules, status, affiliation, and external identity-provider boundaries.

Observe Maya's application-entry boundary

Open Maya Collins and select Impersonate.

Open Workspace → New Application, select the configured product and borrower, enter valid requested terms, and wait for the schedule to update.
Save or submit the application according to the configured workflow. Maya should be able to reopen and update it while that status permits editing.
Open the resulting application and inspect its actions. Approve and Lend must not be available to Maya.
Select Exit impersonation in the header to return to the administrator session.

Synthetic application opened after direct sign-in as Maya Collins, showing Save and Submit without Approve or Lend — After direct sign-in as Maya, the application provides **Save** and **Submit** without **Approve** or **Lend**. Use this fallback when impersonation returns an authentication error.

Observe Daniel's approval and lending boundary

Open Daniel Reed and select Impersonate.

Find Maya's application from the configured application list and open it.
Review the application and use Approve when its status and configured workflow permit that action. Approval records the decision; it does not create a loan.
Use Lend only after the application is approved and ready for lending. Lend changes the application to Issued and creates the loan and contract.
Open the linked loan and confirm it is Active, then select Exit impersonation.

Synthetic application opened after direct sign-in as Daniel Reed, showing the Approve action — After direct sign-in as Daniel, the same application provides **Approve**. This is the visible difference from Maya's access before Daniel records the decision.

The positive and negative observations above establish effective access. A saved permission group by itself does not.

Troubleshooting

What you see	Check
A user cannot find the application list	The saved query's location, visibility, required permission, and the user's List Internal Queries permission.
The application is absent from a visible list	Saved-query conditions, product, status, affiliation, and partner scope.
An expected action is absent	Exact Quote operation permission, application status, required data, and configured decisions.
Authentication error appears during impersonation	Return to the original Finsaku tab or use the browser's Back action. If the administrator header is available, select Exit impersonation; otherwise open the normal Finsaku sign-in page and sign in again as the administrator before continuing. Do not assume impersonation succeeded.
Impersonation remains unreliable	Exit or re-establish the administrator session, then use a separate browser session to sign in directly as the synthetic user. Sign out before switching identities and do not share credentials between users.
A user can do too much	Every active direct group and intermediary-supplied group, not only the group created here.

Use Access model and troubleshooting to trace user status, group status, permissions, saved queries, and affiliation scope in order.