We can get to the Records Management Define Roles tool by going into the Management console and then clicking on the Define Roles entry in the left-hand navigation panel:

The Define Roles tool consists of a table with two columns. The entries in the first column show the available Records Management Roles. In this screenshot, we can see the five default roles. When one of the role entries in the first column is highlighted, then the second column, labeled Capabilities, shows the set of permissions that are enabled for that role.

In the next table, we can see a comparison of the default permissions that are available for each of the five Records Management roles.

We notice that the Records Management Administrator and Records Manager roles are very similar. The main distinction between the two is that the Administrator is able to manage access controls:

A role shown within the Define Roles tool can be edited by first highlighting the role name in the first column on the tool and then clicking on the Edit Role button.

On the Edit Role page, it is possible to edit the permissions that are assigned to the role. Because there are so many permissions, they have been grouped into related feature categories. It is possible to select all permissions of a feature category by selecting the Select All button to the upper-right of that group of entries.

After the new permission settings for the role is complete, we can then click on the Save button at the bottom of the page to update the settings.

Note that there is no user interface to create new permissions, only the ability to assign or remove permission settings for a given role:

A new role can be created by clicking on the New Role button in the Management Console. We note that the pages for creating and editing roles are very similar. When creating a new role, it is necessary to assign a unique name for the role and to then fill out the checkboxes for permissions that are to be assigned to the role.

When we're finished, we press the Create button. The new role will be created and added to the list of available roles. You might be wondering how do we then associate a group with this new role, and do we then need to manually create a group and associate it with the role? It turns out that we don't need to worry about any of that.

If, after creating a new role, we go to the Share Admin Console and navigate into the Groups area, we'll see that a new group has been created with the same name as the new role name that we just created. The group and role are automatically linked.

We can also go over to the Alfresco JSF Explorer client and look at the access controls that are set on that space after creating the new role. When we do that, we can verify that the access controls have automatically been applied to the File Plan root node.

Existing roles can be deleted by clicking on the Delete Role button in the Management Console.

If we try deleting the new role that we just created, we get a popup message that the role was successfully deleted. If we then go back and look in the Groups tool in the Administration Console, we'll see that the group has also been removed. Similarly, if we go to the Explorer client and check the access control entries for the File Plan root node, we'll see that the entry for the new role that we created has now been removed.

So, we see that, behind the scenes, the Records Management console is automatically keeping the Records Management groups, roles, and access control entry information in sync for us.