12.1.3.6 Security

Web Modelers can access the Security button, assign and customize the security settings for EPC objects if:

• They are System Admins
• They are Environment Admins
• They are an user with the Full Control Allow permission
• They are an user with the Read + Write + Delete Permission
  

Web Modelers need to ensure they have the permission to be a Web Modeler, the security designations above, their displayed content is set to Show Latest, and their editing tool is the Web.

*If you are a Web Modeler without any of the security designations above, you should be able to see the Security button in the details tab drop down, but will receive an error message if you try to apply security.

The different levels of security that can be assigned to EPC objects are the following:

Object Hierarchy in EPC

EPC objects always inherit security settings from their parent object. Any change to the security settings is propagated to that object’s children. Objects inherit the cumulative permissions on the objects above them:

• For any given object, the security permissions inherited by their parent are greyed-out/disabled
  

The settings on child objects can be modified without affecting the settings of their parents. For lower level objects, non-inherited permissions can be granted to them. The non-inherited permissions are check-able:

• If a parent object has Allow Read permissions, the child inherits this, and could be granted Allow Write permission.
• If a parent object has Allow Read + Allow Write, the child inherits this, and could be granted Allow Write/Delete permission.
• If a parent has Deny Write/Delete permission, the child inherits this, and could be granted Deny Write.
• If a parent has Deny Write/Delete + Deny Write, the child inherits this, and could be granted Deny Read.
• For all permissions: Permissions can be further Allowed on children in this order: Read, Write, Write/Delete
• For all permissions: Permissions can be further Denied on children in this order: Write/Delete, Write, Read
  

!If a parent has been denied a permission, this denial is inherited by all children, and cannot be overruled. The level of denial can be increased until Read has been denied

Follow the instructions to set Security Permissions for an EPC Object

*The button will appear within the toolbar of the details and graph tabs on each object except “Flow Objects”

1. Navigate to the details section of the object. In this example, an Organization Unit

2. Navigate to the box

3. A drop-down menu will be generated. Choose the “Security” box

4. You will be redirected to the “Edit Security of: [Object] window

*A list will be displayed in this window with the User, Roles and Groups with environment access or Allow/Deny permissions and explicit or inherited permissions on the objects. Some users and roles don’t appear in the list by default if they are not given explicit permissions to the environment or a predecessor object in the hierarchy.

5. To add a user or role to the list, Navigate to “Add User or Role” and select a filter

6. Type the name of the Role you want to set a security permission for the EPC object. From the search suggestions, click to select the Role you want to assign

*The list of Roles will populate based on key word typing

7. The Role will appear on the table under, where the security level can be assigned. By default, the user or role will be granted Allow Read permission. You will receive a notification informing you the permission was added to the object.

8. Navigate to the “Full Control Allow” security level box for the Role

9. Check to the “Full Control Allow” security level box for the Role

10. To remove the permission from the object, click on the “x”