Create a Developer role for the development team. Configure the role with all privileges for tasks and related assets, but only the Read privilege for connections.

Create a Development Team user group and add all members of the development team to the group.

Assign the Developer role to the Development Team group.

If possible, create development connections to sample data. If you have both development and production connections, configure the production connections so that the Development Team group does not have read permission for these connections. This prevents users in the Development Team group from using production connections in tasks.

After testing is complete and tasks are ready to move into production, have an administrator or other qualified user configure the tasks to use production connections.

Edit the Developer role and remove the privilege to run tasks. If development is complete for a task type, you can also remove the privileges to read and update the tasks. By removing the read privilege, you prevent users with the Developer role from accessing information about production tasks.

Create a Reporter role for the reporting team. Configure the role with privileges to read and run tasks and taskflows, and privileges to read, create, and update schedules. Do not enable privileges to create, update, delete or set permissions on assets in the organization.

Create a Reporting Team user group and add all members of the reporting team to the group.

Assign the Reporter role to the Reporting Team group.

Create a custom role called Security Administrator.

Edit the Security Administrator role and grant all privileges except the privileges to create, update, delete, and run tasks, connections, and schedules.

Assign the Security Administrator role to the security administrator.

Create a custom role called Approver. Configure the Run privilege for Application Integration Assets for the Approver role.

Create a user group called Order Approvers.

Assign the Approver role to the Order Approvers group.

Assign the Service Consumer role to the Order Approvers group. You must do this as the Service Consumer role can access and invoke processes.

Assign the users who need to be able to invoke the ApproveOrder process to the Order Approvers group.

To assign access to a group of users, enter the Order Approvers group in the
Allowed Groups
field.
To assign access to a specific user, enter the user in the
Allowed Users
field. You can enter more than one user in the field.

Select the
Application Integration
service, go to the
Assets
tab, and enable all CRUD privileges for
Application Integration Assets
.
Go to the
Features
tab and add the Development, Console Administration, Publish Application Integration Assets, View Application Integration Console, and View Application Integration Designer privileges to the role.
Select the
Data Integration
service, go to the
Assets
tab, and enable all CRUD privileges for the
Project
and
Folder
assets.

Assign the Custom_Dev role to the developer.