I like the idea of adding an Analysts "Profile" page/popup that allows them to quickly view their roles and permissions, and with the option to update these via a workflow template would hopefully allow this to be automated more i.e. just approval tasks. Also means updating the Manage CMDB Task to act on more entities, People, Contracts, Locations, Organizations etc.

Yes, I see this as a very useful feature. If you use the Active Directory Integration to provision officers and customers the AD connector makes use of templates to apply roles and groups to the officers. Due to the number and granularity of a large organizational group structure, using templates to assign groups to individuals is impractical. For example, the Application Services groups structure can be divided by application types as well as locations resulting in hundreds of groups, many with only a couple of individuals per group – or just one.

In order to provide the most efficient group assignment, a group Admin screen needs to be provided that will allow assigned officers to select a group and add officers to that group. Because of the number of groups and individuals that need to be managed, a large organization requires delegation of group assignment management so that group owners can assign individuals to the groups that they manage.

Individual officers often have questions regarding the groups to which they belong and request an update to their default group. A new Admin screen is also needed that allows officers to review their own group membership. To avoid the subscription process for group membership, officers should not be update to update their own groups, however, they will be able to modify their default group selection.