--- schema_version: "1" id: d01510a13bba11056b44f782a7ed8c6c1dbb4267f57a5cc5a83cee4143faf33a title: Permission Sets in Dynamic Revenue Orchestrator collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/ind/264-0-0/dro_permission_sets_in_dynamic_revenue_orchestrator.md canonical_url: https://help.salesforce.com/s/articleView?id=ind.dro_permission_sets_in_dynamic_revenue_orchestrator.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: be541186fd9040e38a441b7d0c6993197a66dae2972ab45c94ff24c95403b173 description: Permission sets extend the user's functional access without changing their profiles and are the recommended way to manage permissions. Dynamic Revenue Orchestrator (DRO) provides standard permission sets for administering DRO, designing fulfillment, managing fulfillment at run time, and submitting transactions. Assign the permission set that matches each user's role. products: - Revenue Cloud release: "264" --- # Permission Sets in Dynamic Revenue Orchestrator Permission sets extend the user's functional access without changing their profiles and are the recommended way to manage permissions. Dynamic Revenue Orchestrator (DRO) provides standard permission sets for administering DRO, designing fulfillment, managing fulfillment at run time, and submitting transactions. Assign the permission set that matches each user's role. ### Required Editions
Available in: Enterprise, Unlimited, and Developer Editions
## How DRO Access Works DRO access requires the Fulfillment User permission set license, which makes users eligible for DRO permission sets and user permissions. A DRO permission set packages the access a role requires: - User permissions enable DRO pages and invocable actions. - Object permissions and field-level security control access to data. - Org-wide defaults and sharing rules control record visibility, which you set up separately. Each user has a profile that provides baseline capabilities, such as activating orders. These profile-level permissions are distinct and should not be included in a permission set. Instead, use permission sets to extend baseline access without modifying the user's profile. To manage profile permissions, see [Create and Configure Standard Profiles](https://help.salesforce.com/s/articleView?id=sfdo.ec_create_and_configure_standard_profiles.htm&type=5&language=en_US). ## DRO Standard Permission Sets Each standard permission set grants a workspace and the supporting access for its role. Choose the narrowest role that supports the user's work. Each standard set is the complete role. It includes supporting permissions from Revenue Management, Context Service, Flow, and the Salesforce Platform, even when their names don't mention DRO. | PERMISSION SET | ASSIGN IT TO | ACCESS AND CONSIDERATIONS | | --- | --- | --- | | DRO Admin User | A Salesforce admin who configures DRO settings, turns on features, and manages the fulfillment framework. | Provides broad access to DRO Setup, design and runtime pages, Context Service administration, flows, product catalogs, and DRO invocable actions. Recommended profile: System Administrator. | | Fulfillment Designer | A back-office user who designs product fulfillment frameworks, workspaces, decomposition and enrichment rules, steps, dependencies, and scenarios. | Provides design and configuration access, including fulfillment editors and product catalog management. Doesn't include DRO invocable action access. | | Fulfillment Manager/Operator | A back-office user who monitors running orders, failed steps, pending tasks, service-level agreement (SLA) status, and jeopardy indicators. | Provides runtime workspace and decomposition viewer access to retry, edit, and complete fulfillment tasks. Grants Create, Read, Edit, and Delete (CRUD) permissions on Fulfillment Steps and read-only access to other DRO objects. Excludes design-time access and DRO invocable actions. | | Submit Transactions User | A user or integration identity that submits transaction requests but doesn't design, monitor, or complete fulfillment. | Grants access to the Submit Order and Submit Sales Transaction invocable actions. Doesn't include DRO design, monitoring, or fulfillment-task access. To submit an order that DRO decomposes and fulfills, also assign Submit Transactions and Fulfillment User. | | Submit Transactions and Fulfillment User | A user who submits a sales order that DRO decomposes and fulfills. | Grants access to order transaction submission, product decomposition and enrichment, runtime workspace, fulfillment controls, and invocable actions. | | Submit Transactions and Orchestrate User | A user who orchestrates a quote, custom object, or other non-sales transaction. | Grants orchestration engine access for non-sales transactions such as quotes or custom objects. | ## DRO User Permissions DRO user permissions are the functional capabilities included in the standard DRO permission sets. They enable specific DRO pages, controls, and invocable actions. When you create custom access, add the applicable DRO user permission. then provide its required supporting permissions, object permissions, and field-level security. | USER PERMISSION (LABEL) | DESCRIPTION | INCLUDED IN PERMISSION SET | | --- | --- | --- | | Administer Dynamic Revenue Orchestrator | Configure DRO and access all DRO pages and actions | DRO Admin User | | Design Fulfillment and Orchestration in Dynamic Revenue Orchestrator | Design fulfillment rules, steps, and scenarios in DRO | Fulfillment Designer | | Run and Monitor Fulfillment in Dynamic Revenue Orchestrator | Manage and monitor fulfillment, and resolve failed or pending fulfillment steps in DRO | Fulfillment Manager/Operator | | Submit and Fulfill Sales Transactions in Dynamic Revenue Orchestrator | Submit orders and sales transactions, trigger fulfillment, and complete fulfillment steps in DRO | Submit Transactions and Fulfillment User | | Submit and Orchestrate Non-Sales Transactions in Dynamic Revenue Orchestrator | Submit non-sales transactions and orchestrate their business processes in DRO | Submit Transactions and Orchestrate User | | Submit Transactions in Dynamic Revenue Orchestrator | Run the Submit Order and Submit Sales Transaction actions in DRO. Combine the user permission with Submit and Fulfill Sales Transactions or Submit and Orchestrate Non-Sales Transactions to complete the transaction. | Submit Transactions User, Submit Transactions and Fulfillment User, and Submit Transactions and Orchestrate User | ## Fulfillment User and Run As User At runtime, DRO executes steps using the configured fulfillment user's permissions, unless a step specifies an alternative in its Run As User field. To configure a fulfillment user, see [Fulfillment User](https://help.salesforce.com/s/articleView?id=ind.dro_fulfillment_user.htm&release=264.0.0&type=5 "A fulfillment user is the user whose permissions are used throughout the fulfillment process, unless you specify a different user at a more granular level. If you don't specifically configure a step to be run by a different user in the Run As User field, then Dynamic Revenue Orchestrator (DRO) uses the fulfillment user's permissions.") and [Create Fulfillment Users for Order Orchestration](https://help.salesforce.com/s/articleView?id=ind.dro_add_a_fulfillment_user.htm&release=264.0.0&type=5 "During fulfillment, Dynamic Revenue Orchestrator (DRO) uses the permissions associated with the fulfillment user rather than those of the user who submits an order. You can specify a different user for certain orchestration tasks, but generally, the permissions default to the fulfillment user. Select the fulfillment user from the Dynamic Revenue Orchestrator Settings pane."). - The fulfillment user must have at least the DRO Admin User or Submit Transactions and Fulfillment User permissions. For automatic assetization, both the submitting user and the fulfillment user require the Assetize Order permission from Revenue Lifecycle Management. - If a step doesn't specify a Run As User, DRO falls back to the fulfillment plan's execution user, then to the org's Automated Process user. - Specify a Run As User on individual steps that require unique privileges, such as making external system callouts. #### See Also - [_Knowledge Article_: Dynamic Revenue Orchestrator Permissions](https://help.salesforce.com/s/articleView?id=005459960&type=1&language=en_US) - [View and Manage Users](https://help.salesforce.com/s/articleView?id=platform.admin_users.htm&type=5&language=en_US) - [Create or Clone Profiles](https://help.salesforce.com/s/articleView?id=platform.users_profiles_cloning.htm&type=5&language=en_US) - [View and Manage Your Permission Set Licenses](https://help.salesforce.com/s/articleView?id=platform.users_permissionset_licenses_view.htm&type=5&language=en_US) - [Provide Dynamic Revenue Orchestrator Access](https://help.salesforce.com/s/articleView?id=ind.dro_provide_user_access.htm&release=264.0.0&type=5 "Assign the appropriate permission set to give users Dynamic Revenue Orchestrator access, and review the permissions included in a permission set.")