12 lines
1.8 KiB
Markdown
12 lines
1.8 KiB
Markdown
# User-profile management workflow
|
|
|
|
The management console separates user classes from restrictive device groups. Profiles have administrator-chosen identifiers and names; the examples do not limit available classes. Employee, developer and high-protection templates populate a local draft; they never silently publish or grant access. Administrators explicitly assign verified enterprise subjects or managed device identifiers.
|
|
|
|
The profile editor supports website allowlists, denylists and centrally maintained domain categories. Categories are administrator supplied host lists, not automatically inferred reputation. The effective preview compares the resulting device policy against the mandatory baseline. Denials accumulate across applicable profiles, and allowlists cannot override a denial.
|
|
|
|
Developer tools grants require separate central delegation. Ordinary employee and high-protection templates deny developer tools. High protection additionally denies downloads and local agents and requires document analysis. The administrator can customize the draft before submitting it. Mandatory DLP and centrally locked or hidden settings remain authoritative.
|
|
|
|
Profile publication and category/delegation publication use the existing policy publisher and independent approval workflow. The review screen displays exact subjects, device assignments, category definitions and feature flags through safe text rendering. On installations requiring independent approval, operators can prepare changes but another administrator must approve. Policy generation conflicts must be refreshed rather than silently overwritten.
|
|
|
|
The assignment table distinguishes a verified subject from an unverified asset-owner label. Explicit device assignment is available when the browser has no authenticated enterprise subject; entering an employee name is not identity verification.
|