Web console - delegating permissions correctly - Advice on best practice

Question

Hi,
I'm in the process of rolling out the Orchestrator Console for wider use within our department.  After reading some posts on Console delegation I have been able to set a group up which when added to the Orchestrator root and Sub dirs, allows the folder
views to be controlled, but only to some degree/very basic.
What I mean - or what I'm finding is that I have what is turning out to be quite a 'deep' tree/subtree folder structure for my runbooks (currently about 4 levels) eg from root folder Runbooks->ProductionRunbooks->ServiceDeskRunbooks->ExchangeRunbooks
- containing 2 exchange runbooks.
So for this structure to delegate to Service desk staff I have created a security group (service desk_console) and given the basic Read permission at Runbook and ProductionRunbooks folder and then Full control (inc child Objects) at ServicedeskRunbooks folder
to allow exectution of any runbooks below this level.
My query is is this the way it should work - I initially thought I could set the read permission at the top level but then just at the Full control permission on the specific low level folder but this didnt work - I had to apply the read permission at each
of the folders between root at target folder.
So as the number of runbooks/folders grows and the possible mix of user groups who will require access to run a particular runbook I can see the delegation of permissions becoming very messy using the method I currently got working - ie with potentially
several 'user groups' I will have to basically set explicitly the permissions for each user group at all levels on all folders?
A possible solution I'm thinking of is to create a 'general console users' group and add the specific user groups to that (eg service desk,Exchange Team,VDI Team) to then set the read permissions on root Runbooks and Production Runbooks folders and then
set Full control specific for the user groups on the folders containing the runbooks pertaining to that user group - any runbooks required by multiple groups could be set in a 'general folder with all groups having FC permissions to it.
Thats my thoughts - seems a bit messy to me but just interested to hear and confirm that thats just the limitation and way console delegation is supposed to work or if there is a neater way I'd like to know!!
Cheers - PS I know this descended into a bit of a ramble/discussion in my own head so apologies ;-)

Answer 1

Hi Stefan, thanks for your reply and suggestion.  What I probably didnt explain, and what I was hoping to achieve in the delegation model was to try and only make visible the folders/runbooks to the relevant operators/user groups.
The issue probably stems from me having a pretty messy folder structure (generally) and me wanting to hide that mess and confusion from operators who will be new to the console.  Basically I have a high level folder called production which underneath
that I create neat and tidy folders/runbooks following a good naming convention - only production ready stuff goes in here and this is the focus of what I want to make visible and control access to.  However I also have High level folder for PreProduction
and Also Testing and within those are a very large number of Folders/runbook which dont follow good naming and can easily loose track when multiple folders are expanded fully.
So my issue with doing the List permission and let it be inherited down the tree then I assume I will be giving the console user the full (list) view of that structure even if they cant execute and runbooks.
So is the only way to enforce views/ and run permission to specify explicit permissions accordingly at each level in the tree, ie you can't skip setting folder permissions at some of the in between 'organizational type' folders - eg from my example above
the ProductionRunbooks->ServiceDeskrunbooks folder/subfolder are just to logically organize the folders containing runbooks such as Exchangerunbooks.  Ideally I would like to set the permissions in such a way that allows the service Desk group to view
the runbooks at the Ecxhangerunbooks subfolder level.
Hope that makes sense - I get the feeling to answer is no and the only way to enforce it is to use the multiple groups/explicit permissions at each level in the folder structure.  Happy to be told otherwise!!...