Security

I have AD authentication to ClearPass Guest working for sponsorship confirmation, but want to scope the role so users in the "approvers" group can ONLY sponsor users and have to access to the rest of ClearPass Guest and/or CPPM.

Is the [Device Registration] role the narrowest it can get?

I have created a custom role, but it doesn't have enough permissions. Which ones are necessary for sponsorship confirmation?

I understood that the only permission required for a sponsor to accept or reject sponsorship clicking in the URLs given in the sponsor email is "remove". Is that correct?

I thought I needed at least "change expiration", "manage guest accounts" and "remove accounts". My sponsorship process lets the sponsor chose the expiration time and I thought it required manage guest accounts. I also addded "create new guest account" so my sponsors can create accounts aoutside of the post-registration email workflow.

Is there a table so I can check what permissions we need granted for each functionality?