OOTB Access When Rules
I realized that several OOTB Access when Rules in 7.1.9 like pxAssignedToMe, pxAssignedToMyOrgUnit ...etc have condition defined as below.
I realized that several OOTB Access when Rules in 7.1.9 like pxAssignedToMe, pxAssignedToMyOrgUnit ...etc have condition defined as below.
-
assignPage.pxAssignedOperatorID = OperatorID.pyUserIdentifier
It assumes the ClipboardPage to be "assignPage" whereas in Clipboard the assignment Page is defined as "newAssignPage".
Are these Access When rules meant only as a template so once can create rules based on these Template or am I missing here something ?
Pegasystems Inc.
US
At the time these Work- Access When rules are invoked, the value passed in for the "assignPage" Page Name parameter is most likely set to "newAssignPage".
Suppose the Assign-Workbasket canPerform Access When rule allows anyone access to a workbasket. This could occur because no Access Role had been assigned to the workbasket which is poor practice. It is best to assign an Access Role to every workbasket. When used properly, these Work- Access When rules would limit access to the case associated to the workbasket assignment.
Something to be careful about is when Data-Admin-Operator-ID linked properties are used to refer to an Org-related Property such as pyWorkGroup. The problem is that the definition:
assignPage.pxAssignedOperatorID.pyWorkGroup = OperatorID.pyWorkGroup
means that the operator's current workgroup must match the workgroup of the Operator to which the assignment is currently assigned.
Suppose someone was a member of a Top Secret workgroup before being moved to a different un-secure workgroup. Unless that person's assignments are transferred to someone else within the Top Secret workgroup, that person will be able to continue to work on those Top Secret assignments.
To prevent this, an Assign-Worklist Access When rule as AssignedToMyWorkGroup can be defined, the definition for which is:
At the time these Work- Access When rules are invoked, the value passed in for the "assignPage" Page Name parameter is most likely set to "newAssignPage".
Suppose the Assign-Workbasket canPerform Access When rule allows anyone access to a workbasket. This could occur because no Access Role had been assigned to the workbasket which is poor practice. It is best to assign an Access Role to every workbasket. When used properly, these Work- Access When rules would limit access to the case associated to the workbasket assignment.
Something to be careful about is when Data-Admin-Operator-ID linked properties are used to refer to an Org-related Property such as pyWorkGroup. The problem is that the definition:
assignPage.pxAssignedOperatorID.pyWorkGroup = OperatorID.pyWorkGroup
means that the operator's current workgroup must match the workgroup of the Operator to which the assignment is currently assigned.
Suppose someone was a member of a Top Secret workgroup before being moved to a different un-secure workgroup. Unless that person's assignments are transferred to someone else within the Top Secret workgroup, that person will be able to continue to work on those Top Secret assignments.
To prevent this, an Assign-Worklist Access When rule as AssignedToMyWorkGroup can be defined, the definition for which is:
.pxWorkGroup = OperatorID.pyWorkGroup
This allows anyone in the same workgroup that created the assignment to open or modify the case, depending how the Access When rule is applied.