syst_perms


Description

Defines the available system and application permissions which can be assigned to users.

The Permission is divided into the following concepts:

  1. The Permission record itself defines a subject for which application security and control concerns exist.

  2. Each Permission is made up of standard Rights. These Rights are:

    • View - the ability to view data.

    • Maintenance - the ability to change or process existing data.

    • Administration - the ability to create or destroy data.

    • Operations - the ability to perform certain operations or processes.

  3. The Right for each Permission is assigned a Scope of applicability which can limit or extend the grant of a Right. Each Right of the Permission may define which Scopes it supports out of the following possibilities:

    • Unused - The Right does not exist in any meaningful way for the Permission.

    • Deny - The Right is not granted by the Permission grant; this is typically used in cases where other Rights may be granted, for example permitting a user to see a value (View Right), but not to Maintain or perform data Admin tasks (Maint & Admin Rights).

    • Same User - The Right grant is limited in Scope to those records which are in some way designated as belonging to the specific user exercising the Right. Ownership designation will be defined by those functions where a Permission is checked.

    • Same Group - The Right grant is limited in Scope to those records which are in some way designated as belonging to a specific group or groups and to which the user belongs in some way. Ownership designation will be defined by those functions where a Permission is checked.

    • All - The Right grant is not limited in Scope and all records which are subject to the Permission are available to the user.

Permissions are assigned to Permission Roles which are in turn granted to individual users. If a Permission is not assigned to a Permission Role, then the assumption is that the Permission Role’s users are denied all rights granted by the unassigned Permission.

Some Permissions may be dependent on the grants of other more fundamental Permissions. For example, a user may be granted only View Rights to the sales order form, but also granted Maintenance Rights to sales pricing data. In such a case the sales order Rights would dictate that the user does not have the ability to maintain sales pricing in the sales order context.

Specific details of applicability and the determination of Scope boundaries will vary by each specific scenario. Consult individual Permission documentation for specific understanding of how determinations of access are made.

Columns

Indexes

Check Constraints

Relationships