Defining access controls for an Access of Role to Object rule

When you define an Access of Role to Object rule, you define access controls for various core functions by role and access class. You can define access controls by using either Access Manager or the Access of Role to Object rule form. The rule form enables somewhat more precise control when entering production levels. For more information about Access Manager, see Access Manager landing page.

You specify access controls by entering either a production level or an Access When rule name. At run time, the system evaluates the value to determine whether access is granted.

• If you enter a When rule name, the system uses the access class and class inheritance to find the Access When rule, and then evaluates the When rule to see if access is granted.
• If you enter a production level, the system compares this level with the production level of the current system. The privilege is granted only if the access control's production level is greater than or equal to the system's production level. Enter 0 or leave blank to provide no access. A value of 5 allows access to all systems.

In the Records Explorer, click Security > Access of Role to Object, open the rule you want to change, and view the Security tab.

You can define the following access controls. For each field, enter a production level or When rule name.

• Open instances – Controls whether users with this access role can open instances of this access class.
• Modify instances – Controls whether users with this access role can save new or modified instances of this access class.
• Delete instances – Controls whether users with this access role can delete instances of this access class.
• Run reports – Controls whether users with this access role can run reports against instances of this access class.
• Execute activities – Controls whether users with this access role can execute activities with an Applies to class that is equal to this access class.

The following Open, Modify, and Delete rules controls are typically needed only by application developers. If you enter a When rule, then at run time, the system uses the class of the primary page to locate the When rule. As a best practice, create the When rule in the Rule- base class.

• Open rules – Controls whether users with this access role can open rules having this access class as a key part.
• Modify rules – Controls whether users with this access role can create or modify rules having this access class as a key part.
• Delete rules – Controls whether users with this access role can delete rules having this access class as a key part.

Open topic with navigation