Roles without compliance tools see a compliance owner role in their list of roles

[gib]

When viewing org members in dashboard, all roles for a member are listed. In the roles migration, admins got put in compliance owner roles regardless of the organization having gridiron / compliance tool access -- Not true.

This list a "compliance owner" role for account owners in orgs that do not have gridiron. They can't view or remove this memberships.

[skylar-anderson]

This list a "compliance owner" role for account owners in orgs that do not have gridiron. They can't view or remove this memberships.

Even if they click on the edit button and edit that way?

[gib]

@sandersonet - I forgot to update here. I looked back over our migrations. We had not intended orgs without Gridiron to have the role. I removed the compliance owner role from the org that created the issue. So the org either:

• downgraded and the compliance owner role removal needs to be added to that process
  OR
• the role was added by accident and we need to query out any orgs with the role that shouldn't have it

I was working on the second here and planned to discuss with @fancyremarker.

[skylar-anderson]

We had not intended orgs without Gridiron to have the role.

Interesting. The current organization bootstrapping logic actually creates the compliance owners role regardless of current plan. I think going forward though, only organizations that were once Pilot+ that then downgraded to Platform- will see the role.

I'm only brining this up because I'm not sure adding the logic to filter role visibility based on plan is worth the added complexity--Although it would be much easier using the authorization service.

[gib]

So new orgs will always get both roles? I agree, that's where we should fix it

[fancyremarker]

@gib: I think our original thinking was that we would indeed create the "Compliance Owners" role for all new organizations, to (a) have only one "bootstrapper" and (b) reduce the number of steps that need to happen when a customer upgrades to Pilot+.

I'm okay changing that, but just wanted to point out that the existing behavior is intentional, if not ideal.