Have you noticed that the deploy and move action for an application is linked to a collection instead of the application object itself?
I have a packager role and a packager scope. There are also collections for them and that's the only thing they can touch. Almost.. They can create apps, collections within their limits and deploy to them. Once an admin changes the scope of a package, removes "packagers" leaving "default", there edit/delete etc. access is revoked. But they still can "deploy", because that action is linked to a collection and not what would make sense to me to the application. I mean the object to control is the application, not the collection, why would "deploy" be part of an collection? Shouldn't deploy always be linked to the object to the deploy and not what to deploy TO? So "deploy" for all classes (app, packages, settings etc.)? Does that make sense to you? I could remove read only access, then they wouldn't see it anymore, hence can't deploy, but I want them to be able to see live apps. Is there a way around that? -Roland
