Privilege Rules

This topic describes the rules available for each Dimensions CM privilege. Each rule specifies the circumstances necessary to activate a privilege for a user.

In this topic:

- Privilege_Rules_Overview

- Available_Privilege_Rules

Privilege Rules Overview

A privilege rule specifies the conditions under which a user has a given privilege. Privilege rules fall into the following categories:

- General Grant Rules, privilege rules that do not designate specific users or groups. The privilege applies to any user who satisfies the rule at that time. For example, a user may have the privilege to action an item if it is in their inbox.

- Explicit Grant/Deny Rules, privileges that can be specifically granted or denied to one or more users or groups. For example, a member of the group TEAMLEADS can create a new project, or a member of the group QA cannot update the contents of an item. These rules take precedence over other rules that grant the same privilege. For example, a General Grant Rule may allow a user to update the attributes of a project/stream if it is in their inbox. If an explicit deny rule is set for the group QA to prevent them from updating project/stream attributes, then a user belonging to group QA would be prevented from updating the attributes of a project/stream even if it was in their inbox.

  Certain privileges relating to promotion and demotion can be specified for specific projects/streams and deployment stages, and privileges for deployment and rollback can also be specified for specific areas.

- Other Grant Rules, privilege rules that specify a role. For example, a user may be allowed to rename a project if they have the role PROJECT_MANAGER for any product, or a user can delete an item if they have the role DEVELOPER on the design part that owns the item.

For details on how to assign privilege rules in the Administration Console, see Managing Privileges.

Available Privilege Rules

The following table provides the complete set of privilege rules and their descriptions. Not all the rules are available for all the privileges.

Name | Rule ID | Description
Explicitly deny to users/groups | USER_DISABLE | The privilege will be explicitly denied for the users/groups listed.
Explicitly grant to users/groups | USER_ENABLE | The privilege will be explicitly granted for those users/groups listed.
Grant to all users | ANYUSER | The privilege will be granted to everyone.
Object is in the user's inbox or the user has current role | OBJ_PEND | The privilege will be granted if the object (a container or category) for which the general grant rule is specified is in the user's inbox or the user has a role on a state transition from the object's current state. For example, a project is in the user's inbox or the user has a role on a state transition from the project's current state. NOTE When the privilege is Action to next state (for Dimensions CM requests, baselines, items, or project/streams) the or in the above rule becomes and. Regarding items and baselines and the behavior of privileges at the initial lifecycle state, the object when first created will only be in the inbox of the originator and therefore only that user, or by default, those in the ADMIN group, can perform the operations required, such as update item, until it is actioned on.
User has any role on any product | ANYROLE_DB | The privilege will be granted if the user has any role on any product in the base database.
User has any role on any transition of the whole stage lifecycle | ROLE_STAGE_LIFECYCLE | The privilege will be granted if the user holds any role on any transition in the whole Global Stage Lifecycle.
User has any role on the design part owning the object | ANYROLE_PART | The privilege will be granted if the user has any role on the design part that owns the object for which the general grant rule is specified.
User has any role on the initial lifecycle state transition | ROLE_INITIAL_LIFECYCLE | The privilege will be granted if the user holds any role on the initial state transition in the lifecycle of the object for which the general grant rule is specified.
User has any role on the object lifecycle | ROLE_LIFECYCLE | The privilege will be granted if the user holds any role on any transition in the whole lifecycle of the object for which the general grant rule is specified.
User has any role on the product owning the object | ANYROLE_PRODUCT | The privilege will be granted if the user has any role on the product owning the object for which the general grant rule is specified.
User has one or more of the following roles on any product | ROLES_DB | The privilege will be granted if the user holds one of the listed roles on any product in the base database.
User has any role on the transition from the current stage to the selected stage | ROLE_STAGE | The privilege will be granted if the user has any role on the transition from the current stage to the selected stage.
User has any role on the transition from the current stage to the selected stage | ROLES_STAGE | The privilege will be granted if the user holds one of the listed roles on any transition to the current stage in the Global Stage lifecycle.
User has one or more of the following roles on the design part | ROLES_PART | The privilege will be granted if the user holds one of the listed roles on the design part owning the object for which the general grant rule is specified.
User has one or more of the following roles on the product | ROLES_PRODUCT | The privilege will be granted if the user holds one of the listed roles on the product owning the object for which the general grant rule is specified.
User has one or more of the following roles on the transition from the current stage to the next stage in the stage lifecycle | ROLES_NEXT_STAGE | The privilege will be granted if the user holds one of the listed roles on the transition from the current stage to the next stage in the Global Stage lifecycle.
User is the originator of the object | ORIGINATOR_OBJ | The privilege will be granted if the current user is the originator/creator of the object for which the general grant rule is specified.

CAUTION! Default Grant Rules for Update and Deliver Privileges

When you create a new base database or upgrade an existing Dimensions 9 installation, the default grant rules for the Update Files from Project/Stream and Deliver Files into Project/Stream privileges include the User holds any role on the product owning the object rule. As a result, there is a security issue where certain users are able to download and upload files from any project in the product including those to which they should not have access. To correct this, you must remove the User holds any role on the product owning the object rule from the grant rules for the Update Files from Project/Stream and Deliver Files into Project/Stream privileges.

Related Topics

Example of Privilege Rules

Privilege Rules Scenario