1Workbench layout (3 panes)
The Access Assignments Workbench is split into three resizable panes. Understanding the layout is the foundation for all the tasks in this guide.
Scope Pane · Assignment Matrix · Impact Preview Panel
Navigate to /identity-core/access-assignments. The workbench fills the page with three horizontal panes.
| jira.reader | jira.writer | github.dev | |
|---|---|---|---|
| Engineering | ✓ | + | ✓ |
| Finance | · | · | − |
What each pane does
| Pane | Position | Purpose | Collapse shortcut |
|---|---|---|---|
| Scope Pane | Left | Collection search and list. Click a collection here to load its current assignments into the matrix. Supports search by name. | [ |
| Assignment Matrix | Center | The interactive grid. Rows = collections, columns = application roles. Click cells to stage operations. A staged-changes bar appears at the bottom when changes are pending. | — |
| Impact Preview Panel | Right | Auto-opens when you have staged changes. Shows a live summary of pending adds and removes. Expands to show full policy preview results after clicking Preview. | ] |
Workbench keyboard reference
| Key | Action |
|---|---|
[ | Toggle the Scope Pane open / collapsed. Collapsing gives more space to the matrix when you know your collections. |
] | Toggle the Impact Preview Panel open / collapsed. |
Ctrl+Enter | Apply staged changes (equivalent to clicking Apply Changes in the staged-changes bar). Requires at least one staged operation. |
Escape | Discard all staged changes and revert the matrix to its last saved state. A confirmation prompt appears before discarding. |
All cell clicks only stage changes in the browser. No API call is made until you click Apply Changes or press Ctrl+Enter. You can safely explore, stage, and unstage before committing.
2Select a collection
Find and click a collection in the Scope Pane
The left Scope Pane lists all collections available in your EmpowerNow deployment. Use the search box at the top of the pane to filter by collection name — the list narrows in real time as you type.
Click any collection row to load it. The Assignment Matrix immediately updates to show the current assignments for that collection: which application roles it already holds, and which are empty.
| Application Role | Status | |
|---|---|---|
| jira.reader | ✓ Granted | |
| jira.writer | Empty | |
| github.dev | ✓ Granted | |
| confluence.viewer | Empty |
Understanding matrix cell states
| Cell appearance | State | Meaning |
|---|---|---|
| ✓ Green checkmark | Granted | This collection currently holds this application role. It is a live, committed assignment. |
| + Blue plus | Pending Add | Staged: this assignment will be created when you apply. Not yet committed. |
| − Red minus | Pending Remove | Staged: this assignment will be removed when you apply. Not yet committed. |
| · Empty | Not Granted | No assignment exists. Click to stage an add. |
3Stage an add operation
Click an empty cell to stage an add
In the Assignment Matrix, locate the row for the collection you want to update. Find the column for the application role you want to grant. If the cell is empty (grey dot), click it.
The cell immediately changes to a pending-add state — it turns blue with a + icon. The Impact Preview Panel on the right opens automatically and shows a summary: "1 role assignment to add."
You can stage multiple cells simultaneously — click as many empty cells as needed. Each click adds to the pending-adds count in the Impact Preview Panel and the staged-changes bar at the bottom of the matrix.
The staged-changes bar
Once any change is staged, a bar appears at the bottom of the Assignment Matrix showing the total count of staged changes and two action buttons.
| jira.reader | jira.writer | github.dev | confluence.viewer | |
|---|---|---|---|---|
| Engineering | ✓ | + | ✓ | + |
| Finance | + | · | · | · |
Stage all the adds you need across multiple collections before clicking Preview. Running Preview once for a batch of changes is more efficient than applying one change at a time, and gives you a holistic SoD (Separation of Duties) picture.
4Stage a remove operation
Click a granted cell to stage a remove
In the Assignment Matrix, locate a cell that shows a green ✓ (Granted). Click it. The cell transitions to a pending-remove state — it turns red with a − icon. The Impact Preview Panel updates to include the new pending removal.
The staged-changes bar reflects the updated count: e.g., "1 add, 1 remove."
Cancel a staged add (click it again)
If you staged an add (blue +) and change your mind, click the cell again. It reverts to the empty state. The staged count decreases by one.
Similarly, clicking a staged remove (red −) again reverts it back to the granted state, cancelling that removal. You do not need to use Escape to undo individual changes — just click the cell.
| Current cell state | What clicking does |
|---|---|
| Empty (·) | Stages an add — cell becomes blue + |
| Granted (✓) | Stages a remove — cell becomes red − |
| Pending add (+) | Cancels the add — cell returns to empty |
| Pending remove (−) | Cancels the remove — cell returns to granted ✓ |
Cancel all staged changes with Escape
Press Escape to discard every staged change at once. A confirmation prompt appears: "Discard all staged changes? This cannot be undone." Confirm to revert the entire matrix to its last committed state.
Using Escape will clear all pending adds and removes — not just the most recent one. If you only want to undo a specific cell, click it directly to toggle it back instead of pressing Escape.
5Run preview
Click "Preview" in the staged-changes bar
Once you have staged at least one change, click the 👁 Preview button in the staged-changes bar (or from the Impact Preview Panel). EmpowerNow evaluates every pending operation against the policy engine and SoD rules without committing anything.
The Impact Preview Panel expands to show per-operation results.
pdp:rule:confluence-engineering-block — requires Confluence tier upgrade approvalUnderstanding preview outcomes
| Result | Colour | Meaning | Next step |
|---|---|---|---|
| ✓ Allow | Green | The operation passes all policy checks. Shows projected member impact (how many people will gain/lose access). | Safe to apply. |
| ⚠ SoD Warning | Amber | The operation triggers a Separation of Duties conflict for some members. The operation can still be applied but the affected members are flagged. | Review the flagged members. Apply cautiously or remove the operation. |
| ✕ Denied | Red | The operation is blocked by a policy rule. The policy reference is shown. The operation will not be committed even if you click Apply. | Remove the staged change or resolve the policy conflict first. |
Running Preview is always safe. It is a read-only evaluation of your staged changes. No membership records are created, updated, or deleted until you click Apply Changes.
6Apply changes
Click "Apply Changes" or press Ctrl+Enter
After reviewing the preview, click ✅ Apply Changes in the staged-changes bar, or press Ctrl+Enter. A confirmation modal opens listing every staged operation. Review the list one final time, then click Confirm Apply.
Reading the apply results
After confirming, EmpowerNow processes each operation against the membership API and reports a result for each one.
| Result code | Meaning | What to do |
|---|---|---|
applied | The change was committed successfully. The assignment is now live. | No action required. Matrix cell updates to the new state. |
denied | The operation was blocked by a policy rule (same as a Preview "Denied"). The change was not committed. | Check the policy reference shown next to the result. Resolve the policy conflict or remove the operation. |
conflict | The underlying assignment state changed between when you staged and when you applied (stale state). The operation was skipped. | Refresh the workbench and retry the operation on the updated matrix. |
error | A non-policy failure occurred (network error, service timeout, etc.). The change may or may not have been committed. | Refresh and check the matrix cell state. If the change is not reflected, retry. If it persists, check the Operations Center for API errors. |
An applied result means the assignment is live. Members of the collection will gain or lose the application role at their next token refresh — typically within seconds for active sessions. There is no grace period after apply.
7Quick Assign flow
A simplified assignment view for single operations
Quick Assign is a streamlined interface for performing a single collection-to-role assignment without opening the full matrix workbench. It is located at /identity-core/quick-assign and is designed for delegated administrators who need to grant access without full workbench permissions.
Quick Assign is ideal for help-desk operators, team leads, or delegated admins who need to grant a single role to a single collection — for example, onboarding a new team into an application. They do not need to see the full assignment matrix or manage multiple changes at once.
Fill in the Quick Assign form
Navigate to /identity-core/quick-assign. The form has four fields.
| Field | Required | Notes |
|---|---|---|
| Collection | ✱ | The subject cohort to assign. Type to search. Only collections you have permission to manage are shown. |
| Application | ✱ | The application whose roles you want to assign to the collection. Changing the application reloads the Role dropdown. |
| Role | ✱ | The specific role within the selected application. Only roles defined for that application are shown. |
| Scope Key | No | Optional resource-level restriction. For example, project:ENG scopes the jira.writer role to only the ENG project. Leave blank for tenant-wide scope. |
Click Assign and confirm
Click ⚡ Assign. Quick Assign runs an immediate preview check and shows the result inline. If the operation is allowed, a success banner confirms the assignment is live. If denied, the policy reference is shown. No separate Apply step is needed — Quick Assign commits immediately on confirmation.
Unlike the full workbench, Quick Assign commits each operation immediately without a staging phase. If you need to assign to multiple roles or multiple collections in one batch, use the Access Assignments Workbench instead.