The security model
ConceptintermediateRole-based access where job, abstract and duty roles decide what a user can do, data roles with security profiles decide what data they can see, and where the configuration lives depends on the phase: a functional area task list during implementation, the Security Console afterwards.
What people get wrong
The confusions are the difficulty. Each one is a belief that sounds right and is not.
- That security is configured in one place. During implementation the tasks sit in a functional area task list; afterwards most sit on the Security Console, and the exceptions are named where they apply.
- That a role hierarchy change takes effect on its own. The data security policies of data and abstract roles must be regenerated when the hierarchy changes.
Recall it
Name the two halves of the security model, say where security tasks live during implementation and after, and state what must be regenerated when the role hierarchy changes.
The functional half is job, abstract and duty roles, deciding what a user can do. The data half is HCM data roles with security profiles, deciding what data they can see. During implementation the tasks sit in a functional area task list or implementation project; afterwards most sit on the Security Console, with exceptions named where they apply. When the role hierarchy changes, the data security policies of data and abstract roles must be regenerated.
Memory hook: Can do versus can see. Task list before, console after. Regenerate when the hierarchy moves.
Rests on SEC-HCM-001, SEC-HCM-003, SEC-HCM-005, SEC-HCM-006.
Taught in
- The Security Model: What You Can Do, What You Can See, and Where It Is ConfiguredRole-based access has two halves — job, abstract and duty roles decide what a user can do, data roles with security profiles decide what they can see — and where the settings live depends on whether the implementation is finished.
- Worker, Assignment, Work Relationship: The Three Records and Their RulesThree records answer three different questions about a person, and the one learners confuse is the pair that can disagree: a nonprimary work relationship whose assignment is still primary. Plus the two date fields that change nothing.
Related
- Terminology glossary — what a term means, and what people get wrong when they use it