Locked Roles are roles whose permissions are inherited regardless of individual settings or inheritance. They allow for the creation of global, task based roles, which are especially important in a multi-host/multi-tenant type environment. Roles and Role permissions can be locked from the Roles & Tabs page.
For example, to create a locked global “Template Manager” role that can edit templates, first go to Roles & Tabs and create the role.
Next, from the Permission tab, select All Hosts and check Publish for the Templates will inherit entry. Check Cascade Changes and click Apply Changes. Now, as soon as the changes are fully cascaded, every template in the system has the Template Manager -> Publish permission.
To lock these changes, right-click on the role in the role hierarchy and check Lock Role. This forces the Template Manager -> Publish permission on all templates and prevents changes to this permission.
Now, any user who has the Template Manger role has Publish permissions to any template on the hosts they have permissions to View and Add children on.
