Executive Summary

Security best practices require operator accounts to have only the minimum privileges necessary for their role. In some cases, operators may have access to Pega development portals and studio experiences such as Dev Studio (Developer), Admin Studio (pxAdminStudio), App Studio and related low-code design experiences (including pxExpress and pxApplicationWizardPortal), or Prediction Studio (pxPredictionStudio).

Alternatively, operators may be assigned Access Roles that permit design-time or administrative actions intended only for developer or administrative personas. This may indicate over-entitlement caused by provisioning patterns, Access Group configuration, or overly broad role assignments.

Immediate action is required to review and restrict Pega development portal access, Access Group assignments, and elevated Access Roles so they align with least-privilege security principles.

Impact

Granting access to Pega development portals and studio experiences such as Dev Studio (Developer), Admin Studio (pxAdminStudio), App Studio and related low-code design experiences (including pxExpress and pxApplicationWizardPortal), or Prediction Studio (pxPredictionStudio), or assigning overly permissive Access Roles, can introduce the following risks:

Root Cause

This issue is typically caused by access configuration and provisioning patterns that assign overly permissive Access Groups, Access Roles, or portal access to operators who do not require them. In Pega, risk is introduced not only by access to development portals such as Dev Studio or App Studio, but by the combination of portal access and the roles included in the Access Group.

In many cases, the assigned roles are the more significant factor because they can allow administrative or design-time actions even when development portal access is limited. 

Pega has observed several recurring causes for excessive studio access: 

• Model operators configured with overly permissive Access Groups: A model operator used for operator provisioning includes Access Groups with development portals and/or roles intended for developer or administrative personas. As a result, newly created operators inherit excessive privileges by default. 

• SSO or directory mappings assigning overly broad access: Identity mappings assign Access Groups that include development portals, administrative capabilities, or Access Roles beyond what the user requires. 

• Temporary or legacy access: Access granted during implementation, testing, or troubleshooting was not removed, leaving development portal access and/or elevated Access Roles in place longer than necessary. 

How can I tell if I’m affected?

Your environment may be impacted if end users, model operators, or broadly assigned SSO or directory-mapped accounts are assigned Access Groups, portals, Access Roles that allow development, administrative, or other design-time actions beyond what their intended persona requires.

An Access Group should be treated as studio-enabled if it exposes development or administrative portals such as Dev Studio, App Studio, Admin Studio, or Prediction Studio, and/or includes roles and privileges that permit design-time or administrative actions.

The supported methods below can be used to identify likely excessive access and then validate whether that access aligns with approved developer, architect, administrator, end-user, or provisioning personas. In addition, please see: Viewing Access Groups and operators

Optional Method 2: Access Group-Centric Review

1. Use the Access Group administration capabilities available in your environment to open each Access Group identified as studio-enabled.
2. For each Access Group, determine which operators, model operators, or mapped populations are associated with it by using supported UI views, reports, or exports available in your environment.
   1. Open the Access Group
   2. View associated operators

This approach can be efficient when the number of operators is large, but findings should still be validated against assigned roles and intended personas.

Optional Method 3: Reporting for Ongoing Governance

Where supported, reporting can be used to make the review repeatable for governance purposes.

1. Create a Report Definition on:
   • Class: Data-Admin-Operator-ID
2. Include fields:
   • .pyUserIdentifier (Operator ID)
   • .pyAccessGroup
3. Apply filter:
   • Access Group IN (list of studio-enabled Access Groups)

Important: Reporting feasibility depends on how Access Group relationships are stored and exposed in your environment. Some configurations may maintain Access Group relationships in structures that affect reporting behavior, completeness, or performance. Any report output should be treated as an aid to identification and validated against Access Group configuration and intended personas.

Optional Method 4: SQL-Based Analysis (Advanced Use Cases Only)

In environments that require large-scale or automated analysis, database-level review may be considered only where it is supported by your operational and governance model.

• Query operator-to–Access Group relationships at the database level
• Filter results based on identified studio-enabled Access Groups

Conceptual example only:

SELECT OperatorID, AccessGroup

FROM pr_operator_access_group_map

WHERE AccessGroup IN ('<studio-enabled-access-group-1>', '<studio-enabled-access-group-2>');

Important considerations:

• Exact table structure and naming may vary by version, deployment model, and client implementation.
• Access Group relationships may require transformation, joins, or interpretation of implementation-specific structures.
• Any SQL-based output should be validated against supported administration views before remediation decisions are made.

Operator Access Validation

To validate that identified operators have studio-enabled access:

• Review Access Group configuration to confirm that it enables studio capabilities.
• Where appropriate, sign in with a representative operator account and confirm access behavior.

Required Actions 

• Restrict studio-enabled access to named developers, architects, and administrators only.
• Remove studio-enabled access from the following:
  • Model operators used for provisioning 
  • End-user Access Groups 
• Create dedicated run-time-only Access Groups for end users.
• Remove the following where no longer required:
  • Legacy or temporary access 
  • Overly permissive configurations

Recommended Target State 

• End users are assigned run-time-only Access Groups; studio-enabled Access Groups are reserved for named developer, architect, and administrator personas.

• Model operators used for automated provisioning, including SSO, LDAP, or other identity-based provisioning mechanisms, are run-time only and do not include studio-enabled Access Groups or elevated Access Roles for end-user populations.

• External identity group mappings are reviewed so that end-user directory groups cannot map to studio-enabled Access Groups. 

• A designated administrator or security owner performs periodic access reviews, including during major releases, after SSO changes, and as part of routine security reviews.

Validation (Post-Remediation) 

Validate remediation by:

• Verifying end users do not have studio-enabled Access Groups 

• Ensuring provisioning sources (model operators and SSO/directory mappings) cannot reassign studio access on login for end-user populations.

• Spot-checking a representative sample of operators against expected personas (end-user run-time vs. named developer/admin). 

• Reviewing monitoring/audit logs for unexpected studio access from end-user populations after changes are deployed.

These changes are configuration-based and can typically be implemented incrementally without downtime.

Frequently asked questions

Next Steps

Review your environments promptly and take corrective action where appropriate. Ensure that Pega development portal access, Access Group assignments, and Access Roles are restricted to authorized developer and administrative personas only.

If you have any questions or concerns, please raise a Support ticket with Global Client Support in My Support Portal for assistance.