When Custom Role Elevates Permissions above Guest, Seat must be consumed on the self-managed installation
Background
When an admin or group owner creates a custom role that gives a user even one more permission than the current guest role (Ultimate Guest MVC here excluded), they need to consume a seat when assigned to a user in the self-managed instance.
Guest users are free with Ultimate. If we let users use Guest as base, but add on X number of permissions, they must be charged for a seat, otherwise we incentivize using custom guest roles to get around consuming paid seats.
Proposal
- A custom role is created that adds 1 or more permissions into guest ("view code" excluded)
- When this role is assigned to a user, a seat is consumed
- Phrased another way, just because a custom role is based on the guest user does not mean it is free with Ultimate
Availability & Testing
Add tests for both forward and backward scenarios i.e.,
- A seat is consumed when a role gains extra permissions and elevates from the guest role.
- A seat is un-consumed when a role loses extra permissions and so, matches guest role.
Edited by Sanad Liaquat