Access Privilege Definitions

You assign accesses in person definitions, policies, and rules. In policies and rules, you can assign or deny accesses to the public (all users), owner, or users (persons, groups, roles, and associations). Users also can grant their accesses for an object to other users.

This table lists and describes the accesses available and shows which administrative objects uses each access.

Access Privilege Description Where Assigned
addinterface Add an interface to an object, relationship, path, or unique key. Person definition

Policy state definition

Rule definition

approve Approve an object for promotion to the next state. Person definition

Policy definition

changename Change the name of a business object. Person definition

Policy definition

changeowner Change the Primary Ownership Vector (POV) and inherited access of a business object. Person definition

Policy definition

changepolicy Change the policy of a business object. Person definition

Policy definition

changesov Change the Secondary Ownership Vector (SOV) and inherited SOV access of a business object. Person definition

Policy definition

changetype Change the type of a business object or relationship. To change a relationship type, the user needs changetype access for the object on both ends of the relationship and on the relationship. Person definition

Policy definition

Rule for relationship

changevault Change the vault of a business object. Person definition

Policy definition

checkin Copy files from the local workstation to a business object. To edit files checked into an object, the user must have checkin, checkout, and lock access for the object. To delete files checked into a business object, a user must have delete, read and checkin access. Person definition

Policy definition

checkout Copy files contained within a business object to the local workstation. Also allows the user to open a file for viewing. To edit files checked into an object, the user must have checkin, checkout, and lock access for the object. Person definition

Policy definition

create Create original and clone existing business objects. Create access applies only for the first state of an object. If a policy gives the owner or the public create access in the first state of an object, anyone can create that type of object. When objects are created, the owner is the one performing the function. To allow only a certain group, role, person, or association to create a specific type of object, deny create access for the owner and public in the object's first state. Then add a user access for the person, role, group, or association that includes create access. Person definition

Policy definition

delete Delete an object from the database. Does not apply to files. To delete files checked into a business object, a user must have delete, read and checkin access. Person definition

Policy definition

demote Change the state of an object to that of a prior state. Person definition

Policy definition

disable Lock a state so that a business object cannot be promoted or demoted. Person definition

Policy definition

enable Unlock the state so that a business object can be promoted or demoted. Person definition

Policy definition

execute Execute a program. A program rule establishes who has the right to use the programs to which it is assigned by setting owner, public, and user accesses in the rule. Applies only to programs executed explicitly by the user: business object methods and those executed from a toolbar. Rule for programs
freeze Freeze, or lock, a relationship so that business objects cannot be disconnected until the relationship is thawed. The type or attributes of a frozen relationship cannot be modified.

When a user attempts to perform a task that requires freeze or thaw access, the system checks the access privileges for the objects on both sides of the relationship (defined in the relevant policies), as well as accesses defined for the relationship type (defined in relevant access rules).

Person definition

Policy definition

Rule for relationships

fromconnect Link business objects together on the "from" side of a relationship. Person definition

Policy definition

Rule for relationships

fromdisconnect Dissolve a relationship on "from" business objects.

When a user attempts to perform a task that requires connect or disconnect access, the system checks the access privileges for the objects on both sides of the relationship (defined in the relevant policies), as well as accesses defined for the relationship type (defined in relevant access rules).

Person definition

Policy definition

Rule for relationships

grant Grant the access privileges the user has for a business object to another user. For more information, see Granted Accesses.

Users cannot grant the grant access itself. Although including grant in the list of accesses will not fail, grantees of the grant access cannot grant, unless they already have grant access.

Person definition

Policy definition

Rule definition

ignore Override the approval or rejection of an object and to sign in place of others. Person definition

Policy definition

lock Restrict other users from checking files into a business object and from opening files for editing. To edit files checked into an object, the user must have checkin, checkout, and lock access for the object.

If an object is governed by a policy with enforce locking turned on, users can only lock the object when checking out a file. Users cannot manually lock the object. Enforce locking prevents one user from overwriting changes to a file made by another user. For more information, see Enforce Clause for the Add Policy Command.

Person definition

Policy definition

modify Edit the attributes of an object or relationship. Person definition

Policy definition

Rule for attributes

Rule for relationships

modifyForm Edit attribute and other field values in a form. Rule for forms
override Disable requirement checking allowing for promotion of an object even when the defined conditions for changing the state have not been met. Person definition

Policy definition

promote Change the state of an object to be that of the next state. Person definition

Policy definition

read View the properties of an object, including basics attributes, states, and history. To delete files checked into a business object, a user must have delete, read and checkin access. Person definition

Policy definition

Rule for attributes

reject Prevent an object from being promoted until it meets the approval of the user. Person definition

Policy definition

removeinterface Remove an interface from an object, relationship, path, or unique key. Person definition

Policy state definition

Rule definition

revise Create a minor revision of the selected business object. This is a synonym for MinorRevise access, which also makes the revision backwards compatible. Person definition

Policy definition

revoke Revoke the access privileges that have been granted for a business object.

Use with caution! Anyone with this privilege can revoke grants for another user.

Person definition

Policy definition

Rule definition

schedule Set and modify schedule dates for the states of a business object. Person definition

Policy definition

show Control whether a user knows that a business object exists. This access privilege prevents a user from ever seeing the type, name, or revision of an object. For more information, see Show Access. Policy definition

Rule definition

toconnect Link business objects together on the "to" side of a relationship. Person definition

Policy definition

Rule for relationships

todisconnect Dissolve the "to" side relationship between business objects.

When a user attempts to perform a task that requires connect or disconnect access, the system checks the access privileges for the objects on both sides of the relationship (defined in the relevant policies), as well as accesses defined for the relationship type (defined in relevant access rules).

Person definition

Policy definition

Rule for relationships

unlock Release a lock placed on a business object by another user. Users can release locks they themselves have placed on objects without this access. Reserve unlock access only for those users who might need to override someone else's lock, such as a manager or supervisor. Unlocking an object locked by another user should be avoided for objects governed by policies with enforce locking turned on. For more information, see Enforce Clause for the Add Policy Command. Person definition

Policy definition

viewForm View a form. A form rule establishes who can view and modify the form to which it is assigned by setting owner, public, and user accesses in the rule. Rule for forms