What are Privileges and Privilege Groups ?
Your Thentia Cloud environment contains sensitive data about your licensees and members of the public. To safeguard this data, it’s important to practice compartmentalization, which means limiting access to data so that authorized users of your Workbench have access to only the data that they need to perform their tasks.
To allow you to compartmentalize the data in your Workbench, Thentia Cloud uses Role-Based Access Control (RBAC). RBAC defines roles based on job functions, and specifies the data access permissions that the role has. Individual authorized users can then be assigned to particular roles, granting them the set of permissions specified for the role.
In Thentia Cloud, the roles are called Privilege Groups, and the data access permissions are called Privileges. Along with System Users (authorized users of the Thentia Cloud Workbench), the relationships between Privilege Groups and Privileges control who can access the data in your Thentia Cloud Workbench, what specific data they have access to, and how they can use that data.
How do Privileges work?
Privileges have two main purposes: they define data access permissions, and they apply those access permissions to users (through Privilege Groups).
Each Privilege defines separate Read Access, Write Access, and Delete Access permissions for specified data in your Thentia Cloud environment:
- Read Access: Controls whether a user can view the specified data.
- Write Access: Controls whether a user can create or change the specified data.
- Delete Access: Controls whether a user can delete the specified data.
When you create a Privilege, you associate it with a specific entity in your Thentia Cloud environment. This scopes the Privilege’s access permissions to the selected entity at the entity level. You can also further scope each individual access permission to the record level:
- Entity-level scope: By default, the Read/Write/Delete permissions specified in the Privilege apply to all records in the entity. For example, if a Privilege grants Read Access to the Profile entity, then any user with this Privilege will be able to view all records in the Profile entity.
- Record-level scope: You can also scope each individual access permission (Read Access/Write Access/Delete Access) so that it only grants that type of access to specific records within the entity (rather than all records). For example, if a Privilege grants Read Access to all records in an entity, but only grants Write Access to records owned by the user, then a user with this Privilege will be able to see all of the records in the entity, but will only be able to make changes to records where they are set as the record owner.
Privileges are enforced across the entire Workbench, in all contexts. For example, if a Privilege restricts a user from seeing records belonging to a particular entity, then that user will not see those records anywhere they might appear, e.g. the entity’s Record List, Summary Views and Connections to the entity within the records of other entities, etc.
Every Privilege is also associated with a specific Privilege Group, which applies the access permissions defined in the Privilege to the users who belong to that Privilege Group.
How do Privilege Groups work?
A Privilege Group is a collection of System Users (users with access to the Thentia Cloud Workbench). Privilege Groups streamline access management by enabling you to manage users with the same or similar data access needs collectively, rather than individually: by associating a Privilege with a Privilege Group, you can conveniently apply the Privilege to all of the members of the group at once.
Since they are used to grant the same data access permissions to groups of users, Privilege Groups are often role-based: they typically correspond to particular job functions, as Workbench users who share job functions generally also need to work with the same data in the same ways.
By default, individual Privilege Groups have a flat structure, which means that all Privilege Groups are at the same level as one another. Optionally, you can also create a hierarchy of Privilege Groups, in which certain Privilege Groups are above (parents) or below (children) of other Privilege Groups. This can be useful if you need Privilege Groups that correspond to the hierarchical levels of your organization, where the permissions for groups that are lower in the hierarchy are typically more restrictive.
How do I use Privileges and Privilege Groups to set up RBAC in my Thentia Cloud Workbench?
Out of the box, a Thentia Cloud environment does not contain any Privileges or Privilege Groups. The default behavior of the system is to give all System Users in the Workbench full access (Read Access, Write Access, and Delete Access) to all entities, unless a more restrictive Privilege exists for a given entity. As a result, we strongly recommend setting up Privilege Groups and Privileges in your Thentia Cloud environment to implement RBAC and ensure proper data compartmentalization.
To do this, you will first need to map out the job functions of your Workbench users and create corresponding Privilege Groups for each job function. To learn more, see
After you have set up your Privilege Groups, you can then design and create Privileges to give the users in each Privilege Group the data access they need to perform their tasks. To learn more, see
Comments
0 commentsPlease sign in to leave a comment.