Creating ABAC policies for a case and a user

You can create hierarchical attributes (to specify a defined ranking of values, represented as integers) and All Of and One Of conditions (to specify how to compare the multivalue attribute types between the user and object) on cases to determine who is authorized to access the case.

Note: You can create policies only for Work-, Data-, and Assign- classes.

1. In Designer Studio, open a case and choose a property field, where you want to enter:
• Multivalue attributes in a comma-separated noun list.
• Hierarchical attributes as a numerical value.

Note: The One Of or All Of comparison operators are case-sensitive and sensitive to extra spaces in the lists of values being compared. For performance reasons, ensure that the column source property values and target values that are compared by these operators are in all uppercase (or all lowercase), with no spaces.

2. Click Save.
3. Click Records > Security > Access Control Policy Condition.
4. Click +Create.
5. In the Label field, enter the policy condition name.
6. In the Context section in the Apply to (class) field, enter the rule, to which the policy applies.
7. In the Add to ruleset field, select a ruleset.
8. Click Create and open.
9. Optional: Click Add conditional logic to configure a filter logic string for the condition.
1. On the Definition tab, in the Conditional logic section, click Add conditional logic as needed to support situations where different logic needs to be applied.
2. In the WHEN field, enter an Access When rule that evaluates whether the conditional logic should be used.
3. In the second field, enter a filter logic string that is applied when the Access When rule evaluates to true. When the set of filters to be applied in an Access Control Policy Condition rule is determined conditionally using Access When rules, leave the filter logic entry blank if you want to enforce no policy condition at all, for example, for certain highly privileged users.
4. In the OTHERWISE field, enter the filter logic string that is used when all of the when rules evaluate to false.
10. In the Policy Conditions section, in the Condition field, enter a condition name.
11. In the Column source field, enter the property in which the case attributes are entered.
12. In the Relationship field, select an attribute, or attributes.

    If you select Is null or Is not null in the Relationship field, the Treat Empty As Null check box is automatically selected. When Treat Empty as Null is checked, even empty values are considered null.

    If you select Is null or Is not null in the Relationship field, the Value field is not active.

13. In the Value field, enter all the attribute values that you want the condition to check.
14. Click Save.
15. Click Records > Security > Access Control Policy.
16. Click +Create.
17. In the Label field, enter the policy name.
18. In the Action list, select one of the actions:
    • Read - The user can open a case that meets the policy conditions or view data for the case in lists, reports, searches, and others.
    • Update - The user can create a case that meets the policy conditions or update data for such a case.
    • Discover - The user can see limited information (defined by a developer) about a case that does not meet the Read policy conditions but does satisfy the Discover policy conditions.
    • Delete - The user can delete a case that meets the policy conditions.
19. In the Context section in the Apply to (class) field, enter a class.
20. In the Add to ruleset field, select a ruleset.
21. Click Create and open.
22. On the Definition tab, select the Disallow creation of a policy with the same name at a descendant class check box to prevent overriding the policy in a descendant class.
23. In the Condition field, enter the policy condition rule name.
24. Click Save.

Open topic with navigation