Question
Pegasystems Inc.
JP
Last activity: 6 Mar 2017 23:13 EST
Precedence of ARO
Hi,
Scenario (1)
I have cloned Access Role Name (Rule-Access-Role-Name) from out-of-the-box role (PegaRULES:WorkMgr4) and there I had added our application specific Work class ARO (i.e. MyCo-MyApp-Work-PurchaseRequest class). When I give 0 or false by Access-When for this class ARO, user can NOT able to open an instance of this PurchaseRequest class. This behavior is expected.
Scenario (2)
Now, we are trying to segregate our application specific access role from out-of-the-box and I have taken out and created a new ARO which has only a row of MyCo-MyApp-Work-PurchaseRequest class. In an access group I gave this new access role plus PegaRULES:WorkMgr4 access role. My expectation is this works just the same as above scenario (1) but it is not. When I give 0 or false by Access-When for this class in new ARO, user is still able to open a work object of this class. I have not customized anything other than our PurchaseRequest work type class.
PegaRULES:WorkMgr4 access role name has full access 5 in Work- class but in my understanding, this Work- access control should be ignored because ARO has more specific PurchaseRequest work class. That is why I believe Scenario (1) is behaving like expectation. Why scenario (2) does not behave this like this? Having one access role and two access roles for the same definition make any difference? Am I missing anything?
***Updated by moderator: Lochan to add Categories***
Accepted Solution
Pegasystems Inc.
IN
Hello,
This question is now Answered by one of our SMEs on an internal forum. Below is the resolution.
The access to a case seems to be determined by following logic;
- Get the most specialized class ARO to a case per Access Role.
- Collect access from each Access Role and falls positive (1. true and true => true 2. true and false => true 3. false and false => false)
Scenario 1)
Access Group
1. PegaRULES:WorkMgr4 Access Role
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is Work- and it is full access (true), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). true and false makes true.
Scenario 2)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives no access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false).
Hello,
This question is now Answered by one of our SMEs on an internal forum. Below is the resolution.
The access to a case seems to be determined by following logic;
- Get the most specialized class ARO to a case per Access Role.
- Collect access from each Access Role and falls positive (1. true and true => true 2. true and false => true 3. false and false => false)
Scenario 1)
Access Group
1. PegaRULES:WorkMgr4 Access Role
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is Work- and it is full access (true), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). true and false makes true.
Scenario 2)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives no access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false).
Scenario 3)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives no access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). false and false makes false.
Scenario 4)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (full access, 5)
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is full access (true), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). true and false makes true.
Scenario 5)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (full access, 5)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is full access (true). false and true makes true.
Scenario 6)
Access Group A
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:TestX that contains one ARO of MyCo-MyApp-Work-PurchaseRequest-Div1 (full access, 5)
Against PurchaseRequest case:
This gives no access because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest in 2. false and false makes false.
Against PurchaseRequest-Div1 case:
This gives access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div1 in 1, and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest-Div1 and it is full access (true). false and true makes true.
Against PurchaseRequest-Div2 case:
This gives no access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div2 in 1, and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div2 in 2. false and false makes false.
Access Group B
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:TestY that contains one ARO of MyCo-MyApp-Work-PurchaseRequest-Div2 (full access, 5)
Against PurchaseRequest case:
This gives no access because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest in 2. false and false makes false.
Against PurchaseRequest-Div1 case:
This gives no access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div1 in 1, and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div1 in 2. false and false makes false.
Against PurchaseRequest-Div2 case:
This gives access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div2 in 1, and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest-Div2 and it is full access (true). false and true makes true.
Thank you!
Pegasystems Inc.
JP
Hi,
I have added step by step experiments attachment so it is easier to understand what I am trying to ask.
Thanks,
Accepted Solution
Pegasystems Inc.
IN
Hello,
This question is now Answered by one of our SMEs on an internal forum. Below is the resolution.
The access to a case seems to be determined by following logic;
- Get the most specialized class ARO to a case per Access Role.
- Collect access from each Access Role and falls positive (1. true and true => true 2. true and false => true 3. false and false => false)
Scenario 1)
Access Group
1. PegaRULES:WorkMgr4 Access Role
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is Work- and it is full access (true), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). true and false makes true.
Scenario 2)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives no access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false).
Hello,
This question is now Answered by one of our SMEs on an internal forum. Below is the resolution.
The access to a case seems to be determined by following logic;
- Get the most specialized class ARO to a case per Access Role.
- Collect access from each Access Role and falls positive (1. true and true => true 2. true and false => true 3. false and false => false)
Scenario 1)
Access Group
1. PegaRULES:WorkMgr4 Access Role
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is Work- and it is full access (true), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). true and false makes true.
Scenario 2)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives no access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false).
Scenario 3)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives no access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). false and false makes false.
Scenario 4)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (full access, 5)
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is full access (true), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false). true and false makes true.
Scenario 5)
Access Group
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:Test that contains one ARO of MyCo-MyApp-Work-PurchaseRequest (full access, 5)
This gives access to PurchaseRequest case because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest and it is full access (true). false and true makes true.
Scenario 6)
Access Group A
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:TestX that contains one ARO of MyCo-MyApp-Work-PurchaseRequest-Div1 (full access, 5)
Against PurchaseRequest case:
This gives no access because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest in 2. false and false makes false.
Against PurchaseRequest-Div1 case:
This gives access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div1 in 1, and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest-Div1 and it is full access (true). false and true makes true.
Against PurchaseRequest-Div2 case:
This gives no access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div2 in 1, and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div2 in 2. false and false makes false.
Access Group B
1. MyApp:User that is cloned from PegaRULES:WorkMgr4 and one additional ARO of MyCo-MyApp-Work-PurchaseRequest (no access, 0)
2. MyApp:TestY that contains one ARO of MyCo-MyApp-Work-PurchaseRequest-Div2 (full access, 5)
Against PurchaseRequest case:
This gives no access because the most specialized class ARO in 1 is MyCo-MyApp-Work-PurchaseRequest and it is no access (false), and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest in 2. false and false makes false.
Against PurchaseRequest-Div1 case:
This gives no access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div1 in 1, and there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div1 in 2. false and false makes false.
Against PurchaseRequest-Div2 case:
This gives access because there is no corresponding class ARO for MyCo-MyApp-Work-PurchaseRequest-Div2 in 1, and the most specialized class ARO in 2 is MyCo-MyApp-Work-PurchaseRequest-Div2 and it is full access (true). false and true makes true.
Thank you!