---
title: "Inherited Authorities and Sub-Roles"
canonical: "https://docs.rubiconwater.com/space/UMNC/1983643715/Inherited%20Authorities%20and%20Sub-Roles"
format: markdown
---
A parent role can have child sub-roles from which it inherits access to product functionality. This can be a useful way to quickly add functionality to a role.  

> ℹ️ **Note**
> ℹ️ 
> ℹ️ - This inheritance is only one level deep. You cannot inherit authorities from the child of a child role.
> ℹ️ - Although privilege checks apply for all DIRECT roles that a user has, they are not required for sub-roles that a user may hold.

# Add a Child Sub-Role to a Parent Role

This is done by giving the parent role *Grant Authority* privileges over the child sub-role.

> ℹ️ **Caution**
> ℹ️ 
> ℹ️ You should consider whether you want to turn off inheritance for security sensitive modules to avoid inadvertently granting access to these modules when you are configuring *Grant Authority* sub-role privileges. 
> ℹ️ 
> ℹ️ Note that you will then have to explicitly add an authority for these functions to roles that need them.

1. In the Roles module, open the **Sub-Role Privileges **tab.
2. Click **Insert **to add a new privilege.
3. In the dialog box:
  - Select the **Role** that you want to add.
  - Select the *Grant Authority* privilege.
4. Click **Save** to save your changes.

# How can I tell what functions a role has inherited?

- You can see both the direct and the inherited authorities by viewing all the authorities in the [https://rubiconwater.atlassian.net/wiki/spaces/UMNC/pages/1979449436](https://rubiconwater.atlassian.net/wiki/spaces/UMNC/pages/1979449436) which displays both direct and inherited authorities for each role. See [https://rubiconwater.atlassian.net/wiki/spaces/UMNC/pages/1985052761/Authority+Inheritance#Viewing-Inherited-Authorities](https://rubiconwater.atlassian.net/wiki/spaces/UMNC/pages/1985052761/Authority+Inheritance#Viewing-Inherited-Authorities) for details.
- To see what roles have child sub-role status for a role, check the **Sub-Role Privileges** tab of the Roles module. Any role for which the privileges *Grant Authority* has been assigned will behave as a child sub-role of the parent role.

# How can I stop an authority for a security function, module or report from being inherited?

Use the Security Manager to turn off inheritance for a specific authority. This stops the authority from being inherited by any role. See [https://rubiconwater.atlassian.net/wiki/spaces/UMNC/pages/1985052761/Authority+Inheritance#Preventing-an-Authority-from-Being-Inherited](https://rubiconwater.atlassian.net/wiki/spaces/UMNC/pages/1985052761/Authority+Inheritance#Preventing-an-Authority-from-Being-Inherited) for more details.

---