What should Annie do first if a parent role needs to be updated with constraints?

The most effective first step for Annie when updating a parent role with constraints is to remove the permission from the child role. This is because any changes made at the parent role level can have implications for the child roles, and removing a specific permission from the child role ensures that it does not inherit the undesired permission from the parent role.

In Cornerstone OnDemand, the hierarchy of roles means that child roles derive their permissions from their parent roles. If Annie intends to impose new constraints that might not be relevant or appropriate for the child roles, handling the permissions directly at the child level can be a more direct way to ensure that their access is correctly aligned with the new constraints. By doing this, she can prevent any potential conflicts or issues later on when the parent role is updated, as changes might inadvertently affect all children if permissions are simply removed at the parent level.

This approach also maintains clarity in the role permissions structure. Instead of reassigning permissions across multiple child roles or removing permissions from the parent role, which could lead to unintended permissions being stripped from child roles, adjusting the child role directly is a more precise action. This allows for a tighter control over what each child role can access without disrupting the overarching permissions set by the parent role.

Overall