‘Manage family support services and accounts’ and 'Manage connection request' services with accounts which are set up by staff with a ‘manager’ role. We discuss this in a previous design history about adding permissions.
Managing user permissions
Different types of manager have access to different things. We’ve done this so that user information is only viewed and managed by relevant people and not by everyone.
Managers from the Department for Education (DfE) can manage all user permissions. Managers from local authorities can only manage users within their own local authority area. This means they can manage other local authority users, and users from voluntary and community sector (VCS) organisations.
Sorting the list of user accounts
When a manager selects ‘manage permissions’, they are presented with a table view showing all users. We’ve made this sortable, so that users can sort by whichever column works for them. The default view is sorted by name. We’ve chosen to show the name, email address and organisation the user works for. If we used more columns, the table would not work well when viewed on mobile devices.
We’ve added a filter panel so that users can use a name, email address or organisation to find the user they need. They can also select whether the user is a local authority or a VCS user. There is no validation around filtering because we want filtering to be optional – only if managers want to use it.
We’ve used the standard GOV.UK design pattern for pagination, which lists 10 users per page.
There are two calls to action on each row of users in the table view, one for edit, one for delete. This is consistent with other functionality across the service, for example in ‘manage services’.
Editing users
Selecting ‘edit’ against a user’s name allows managers to edit their email address or role type. Managers cannot edit users’ names – users will be able to do this themselves in the ‘my account’ area.
For each change, the service sends an email to the user whose account has been edited telling them what has changed and what that means for them. The information on ‘what that means’ is a strong need we identified from user research.
You can view the table and explore the ‘edit’ function in the manage user permissions area of our prototype (password: proto). Ben Smith is the local authority user account that can be edited and John Jones is the VCS user account. When we develop the design into the service, all users listed in the table will be editable.
Changing account permissions
One of the ‘edit’ functions that manager users can do is change the permissions a user has.
The permissions associated with a user’s account give them access to ‘Manage family support services and accounts’, ‘Manage connection requests’ or to both services.
When a manager edits a user’s permissions, they are presented with checkbox options for the question ‘What do they need to do?’. Their selection determines the change, and they are then shown a confirmation screen, which explains that we’ve sent the user an email to let them know that their permissions have changed.
Changing email addresses
Editing an email address only changes the email address we hold for the user permissions. The user has to sign in with their new email address. To do this, they will need to create a new GOV.UK One Login account with the new email address. We send the user an email to explain how to do this.
Because the email address has been updated in our service, we’ll retain all the existing information about the user. They will be able to access it when they sign in again.
Deleting users
When a manager deletes a user’s permissions, we give them ‘yes’ or ‘no’ radio options before doing it. When the permissions are deleted, we send an email to the user letting them know they no longer have access to our services.
What we did next
We tested the journey of signing into the service for the first time and giving permissions to other users with local authority managers.
The word ‘permissions’ did not test well, with users noting:
- ''I think it's just the word 'permissions’ (that is confusing). I think you're adding an account.”
- “’Permissions’ is more permission to share someone’s information. You’re adding a user.”
- “Am I adding their permissions or am I adding a new person?”
So we replaced it with ‘user’, ‘account’ or something else (for example, changing ‘‘Type of permission’ to ‘What they can do’).
Other examples include changing:
- ‘Add permissions’ to ‘Add a user’
- 'Permissions updated’ to ‘Account updated’
- ‘Who are you adding permissions for?’ to ‘What type of user are you adding’?
- ‘Yes, delete the permissions’ to ‘Yes, delete this account’
We hope these changes will make the content less confusing for users.
Future considerations
Users currently cannot edit the organisation a user works for. It’s not a need we’ve identified, but we will keep monitoring this in user research.