Authorization management for Adobe Launch

The authorization management of Adobe Launch can be represented by the following figure:

Adobe Launch permissions are divided into two categories,：

Experience Cloud Permissions: which is the administrator level and product level authorization management,Found in the Admin Console at the company level, Experience Cloud permissions govern who can control group permissions and group membership for all Experience Cloud products.
Launch Permissions: which is the real permission management in Adobe Launch.,The permissions for Launch, one of the Experience Cloud products, are found in the Admin Console at the Product Profile level. Launch permissions govern which users can actually perform certain actions when logged into Launch.

Experience Cloud Permission This part is the system administrator and product management, divided into Organization Administrator and Product Administrator

The Organization Administrator is the system administrator, the super root of the system, and the system administrator at the Adobe Experience Cloud level. This administrator is divided into Product, User Group, Deployment, Support and Storage. The most commonly used product is Product. Because Adobe needs to be authorized at the product level, you can access this product and perform authorization management on this product. Each product under Adobe Experience Cloud is independently authorized. It should be noted that the authorization at this level is the authorization of the product.

The Product Administrator is the product administrator and is the product super root. This role is established when group authorization is established. A Product Administrator (or Product Admin) is similar to an Org Admin, but is narrower in scope. A Product Admin only has the permission to modify Product Profiles for a specific Adobe product, rather than all Adobe products the company has access to.

Adobe Launch authorization is through group authorization, which is also called Profile. By establishing a group, this group has some permission types. All people in this group have the same type of permissions. One person can be in multiple groups at the same time .

Product Administrator can authorize a group administrator for this group and let this group administrator manage this group.

The grouped permission type is Launch Permission. It is divided into Company Right and Property Right. This is based on the account structure of Adobe Launch, because the account structure of Adobe Launch is Adobe ID-Organization-Property. Property corresponds to a website or app, and is Property Right.

Company Right has two types of permissions,

Manage Properties: Grants the ability to create new properties in Launch and to modify the metadata and settings at the property level. You can also delete properties.. Administrators usually perform this role.
Develop Extensions: Grants the ability to create and modify extension packages that are owned by the company including private releases and requests for public release.

Property Right has 5 types of permissions,

Develop: Grants the ability to create rules and data elements. You can also create libraries and build them in existing development environments. You can submit a library for approval when ready. Most day-to-day tasks in Launch require this right.
Approve: Grants the ability to take a submitted library and build to the staging environment. You can also approve a library for publishing once testing has been completed.
Publish: Grants the ability to publish approved libraries to the production environment.
Manage Extensions: Grants the abilities to install new extensions to a property, to modify the extension configuration for an already installed extension, and to delete an extension.. This role typically belongs to IT or Marketing, depending on your organization.
Manage Environments: Grants the ability to create and modify environments. This role typically belongs to the IT group.