&KDSWHU

 #REATING AND MANAGING ACCESS

CONTROL LISTS !#,S

7\SHV RI DFFHVV FRQWURO OLVWV $&/V

4HERE ARE THREE TYPES OF !#,S
s 2ULE TREE !#,
4HESE !#,S CONTROL ACCESS TO GENERAL DATA CREATION 4HEY ARE MANAGED THROUGH
!CCESS -ANAGER

s 7ORKmOW !#,
4HESE !#,S CONTROL ACCESS TO DATA THAT IS IN PROCESS AT A PARTICULAR RELEASE LEVEL
4HEY PROVIDE A SUBSET OF !CCESS -ANAGER FUNCTIONALITY THAT CAN BE ACCESSED
FROM 7ORKmOW $ESIGNER

s 0ROJECT !#,
4HESE !#,S CONTROL ACCESS TO PROJECT DATA 4HEY PROVIDE A SUBSET OF !CCESS
-ANAGER FUNCTIONALITY THAT CAN BE ACCESSED FROM 0ROJECT

$FFHVV SULYLOHJHV
3YMBOL 0RIVILEGE $ESCRIPTION
2EAD #ONTROLS THE PRIVILEGE TO OPEN AND VIEW
AN OBJECT
7RITE #ONTROLS THE PRIVILEGE TO CHECK THE OBJECT
INOUT OF THE DATABASE AND MODIFY IT
$ELETE #ONTROLS THE PRIVILEGE TO DELETE THE OBJECT

#HANGE #ONTROLS THE PRIVILEGE TO MODIFY OBJECT

PROTECTIONS THAT OVERRIDE THE RULES BASED
PROTECTION FOR THE OBJECT 9OU MUST HAVE
CHANGE PRIVILEGES TO APPLY OBJECT BASED
PROTECTION OBJECT !#,S 
0ROMOTE #ONTROLS THE PRIVILEGE TO MOVE A TASK
FORWARD IN A WORKmOW PROCESS
$EMOTE #ONTROLS THE PRIVILEGE TO MOVE A TASK
BACKWARD IN A WORKmOW PROCESS

3/0 . !CCESS -ANAGER 'UIDE 

&KDSWHU  #REATING AND MANAGING ACCESS CONTROL LISTS !#,S

3YMBOL 0RIVILEGE $ESCRIPTION

#OPY #ONTROLS THE PRIVILEGE TO COPY AN OBJECT
AS A NEW OBJECT
1RWH )T STILL ALLOWS COPY AND PASTE OF
THE OBJECT AS A REFERENCE WITH NO
NEW OBJECT CREATED
#HANGE OWNERSHIP #ONTROLS THE PRIVILEGE REQUIRED TO GRANT
CHANGE OR RESTRICT OWNERSHIP RIGHTS TO AN
OBJECT
0UBLISH #ONTROLS THE PUBLISH PRIVILEGE TO USERS OR
GROUPS
3UBSCRIBE #ONTROLS THE PRIVILEGE TO SUBSCRIBE TO AN
EVENT ON A SPECIlED WORKSPACE OBJECT
%XPORT #ONTROLS THE PRIVILEGE TO EXPORT OBJECTS
FROM THE DATABASE
)MPORT #ONTROLS THE PRIVILEGE TO IMPORT OBJECTS
IN TO THE DATABASE
4RANSFER OUT #ONTROLS THE PRIVILEGE TO TRANSFER
OWNERSHIP OF OBJECTS WHEN THEY ARE
EXPORTED FROM THE DATABASE
4RANSFER IN #ONTROLS THE PRIVILEGE TO ASSIGN OWNERSHIP
OF OBJECTS WHEN THEY ARE IMPORTED IN TO
THE DATABASE
7RITE #LASSIlCATION #ONTROLS THE PRIVILEGE TO WRITE
)#/ #LASSIlCATION OBJECTS )#/S 
!SSIGN TO PROJECT #ONTROLS THE PRIVILEGE TO ASSIGN AN OBJECT
TO A PROJECT 4HIS APPLIES TO USERS WHO ARE
NOT DESIGNATED AS PRIVILEGED PROJECT TEAM
MEMBERS
1RWH 4HE VALIDATION OF THE !SSIGN
TO PROJECT PRIVILEGE IN
CONJUNCTION WITH PRIVILEGED
PROJECT MEMBERSHIP IS EVALUATED
BASED ON THE VALUE OF THE
4#?PROJECT?VALIDATE?CONDITIONS
PREFERENCE

 !CCESS -ANAGER 'UIDE 3/0 .

 #REATING AND MANAGING ACCESS CONTROL LISTS !#,S

3YMBOL 0RIVILEGE $ESCRIPTION

2EMOVE FROM #ONTROLS THE PRIVILEGE TO REMOVE AN OBJECT
PROJECT FROM A PROJECT 4HIS APPLIES TO USERS WHO
ARE NOT DESIGNATED AS PRIVILEGED PROJECT
TEAM MEMBERS
1RWH 4HE VALIDATION OF THE !SSIGN
TO PROJECT PRIVILEGE IN
CONJUNCTION WITH PRIVILEGED
PROJECT MEMBERSHIP IS EVALUATED
BASED ON THE VALUE OF THE
4#?PROJECT?VALIDATE?CONDITIONS
PREFERENCE
2EMOTE CHECKOUT #ONTROLS THE PRIVILEGE TO REMOTELY CHECK
OUT AN OBJECT
5NMANAGE %NABLES USERS TO CIRCUMVENT THE
BLOCKING IMPLEMENTED USING THE
4#?SESSION?CLEARANCE PREFERENCE
&OR MORE INFORMATION ABOUT SESSION
CLEARANCE SEE THE 3ECURITY !DMINISTRATION
'UIDE
)0 !DMIN %NABLES USERS TO ADD USERS TO MANAGE )0
LICENSES
&OR MORE INFORMATION SEE THE !UTHORIZED
$ATA !CCESS ,ICENSE 'UIDE
)4!2 !DMIN %NABLES USERS TO ADD INFODBA USERS TO
MANAGE )4!2 LICENSES
&OR MORE INFORMATION SEE !UTHORIZED
$ATA !CCESS ,ICENSE 'UIDE
#)#/ 'RANTS A USER THE ABILITY TO OVERRIDE THE
CHECKOUT OF AN OBJECT BY ANOTHER USER )T
LETS THE USER WITH THE OVERRIDE PRIVILEGE
CHECK IN TRANSFER OR CANCEL THE CHECKOUT
OF THE OBJECT
1RWH #)#/ IMPACTS AN USERS ABILITY
TO CHECK OUT OBJECTS WHEN THEY DO
NOT HAVE 7RITE ACCESS (OWEVER IT
DOES NOT IMPACT THEIR ABILITY
TO MODIFY THE OBJECT ONCE IT IS
CHECKED OUT

([DPSOH )F "OB CHECKS OUT AN OBJECT

ITEM AND FORGETS TO CHECK
IT BACK IN BEFORE LEAVING ON
VACATION THE #)#/ PRIVILEGE
CAN BE GRANTED TO THE PROJECT
MANAGER 5MA SO SHE CAN

3/0 . !CCESS -ANAGER 'UIDE 

&KDSWHU  #REATING AND MANAGING ACCESS CONTROL LISTS !#,S

3YMBOL 0RIVILEGE $ESCRIPTION

CHECK ITEM BACK IN AND THE
PROJECT CAN PROCEED

4RANSLATION #ONTROLS THE PRIVILEGE TO ADD TRANSLATED

TEXT USING THE /RFDOL]DWLRQ BUTTON
&OR MORE INFORMATION SEE THE ,OCALIZATION
'UIDE
6IEW-ARKUP #ONTROLS THE PRIVILEGE TO VIEW AND CREATE
MARKUPS
&OR MORE INFORMATION SEE 'ETTING 3TARTED
WITH $OCUMENT -ANAGEMENT
"ATCH 0RINT #ONTROLS THE PRIVILEGE TO PRINT MULTIPLE
OBJECTS
&OR MORE INFORMATION SEE 'ETTING 3TARTED
WITH $OCUMENT -ANAGEMENT
$IGITAL 3IGN #ONTROLS THE PRIVILEGE TO DIGITALLY SIGN A
DOCUMENT 4HE #OMMERCIAL /FF 4HE 3HELF
#/43 $IGITAL 3IGN $ATASET !#, RULE
GRANTS OWNING USER AND OWNING GROUP
DIGITAL SIGN PRIVILEGES FOR THE DATASET
OBJECT 7ORLD USERS DO NOT HAVE DIGITAL
SIGN PRIVILEGES
!DMINISTER !$! #ONTROLS THE PRIVILEGE TO CREATE MODIFY OR
,ICENSES DELETE !$! LICENSES FOR USERS IN THE !$!
,ICENSE APPLICATION
&OR MORE INFORMATION SEE THE !UTHORIZED
$ATA !CCESS ,ICENSE 'UIDE AND THE
3ECURITY !DMINISTRATION 'UIDE
&OR MORE INFORMATION SEE THE !UTHORIZED
$ATA !CCESS ,ICENSE 'UIDE AND THE
3ECURITY !DMINISTRATION 'UIDE
)0 #LASSIlER #ONTROLS THE PRIVILEGE TO CLASSIFY
INTELLECTUAL PROPERTY )0 INFORMATION
&OR MORE INFORMATION SEE THE !UTHORIZED
$ATA !CCESS ,ICENSE 'UIDE

 !CCESS -ANAGER 'UIDE 3/0 .

 #REATING AND MANAGING ACCESS CONTROL LISTS !#,S

3YMBOL 0RIVILEGE $ESCRIPTION

)4!2 #LASSIlER #ONTROLS THE PRIVILEGE TO CLASSIFY
INTERNATIONAL TRAFlC IN ARMS )4!2
INFORMATION
&OR MORE INFORMATION SEE THE !UTHORIZED
$ATA !CCESS ,ICENSE 'UIDE
2EMOVE #ONTENT !LLOWS A USER OF TH 'ENERATION
$ESIGN '$ TO REMOVE CONTENT FROM A
COLLABORATIVE DESIGN #$  FOR EXAMPLE TO
REMOVE AN EXISTING DESIGN ELEMENT
&OR MORE INFORMATION SEE TH 'ENERATION
$ESIGN 'UIDE
!DD #ONTENT !LLOWS A USER OF '$ TO ADD CONTENT TO A
#$ FOR EXAMPLE TO CREATE A NEW DESIGN
ELEMENT
&OR MORE INFORMATION SEE TH 'ENERATION
$ESIGN 'UIDE

$FFHVVRU SUHFHGHQFH
!N ACCESSOR IS A USER OR GROUP OF USERS WHO SHARE CERTAIN TRAITS SUCH AS MEMBERSHIP
IN THE GROUP THAT OWNS THE OBJECT OR MEMBERSHIP IN THE PROJECT TEAM 4HE FOLLOWING
LIST PRESENTS THE PREDElNED ACCESSORS DELIVERED WITH 4EAMCENTER IN ORDER OF
PRECEDENCE FROM MOST RESTRICTIVE TO LEAST RESTRICTIVE 4HE MORE RESTRICTIVE THE
ACCESSOR THE HIGHER PRECEDENCE IT HAS OVER OTHER ACCESSORS
1RWH s 7HEN TWO ACCESSORS WITH DIFFERENT PRECEDENCES ARE ADDED TO A NAMED
!#, CONlGURATION THE HIGHEST PRECEDENCE ACCESSOR IS AUTOMATICALLY
MOVED TO THE TOP IN THE !#, TABLE

s 7HEN TWO ACCESSORS WITH THE SAME PRECEDENCE ARE ADDED TO A NAMED
!#, CONlGURATION THEY STAY IN THE ORDER THEY ARE ADDED

s 4HE 2OLE IN 'ROUP 2OLE IN /WNING 'ROUP 2OLE IN 0ROJECT AND

2OLE IN 0ROJECT OF /BJECT ACCESSORS WORK ON THE SUPERSET OF ROLES
THE USER POSSESSES IN THE RELEVANT GROUP OR PROJECT RATHER THAN ON THE
SESSION CURRENT ROLE

s 7HEN THE 4#?CURRENT?ROLE PREFERENCE IS SET IT AFFECTS THE EVALUATION OF

THE 2OLE IN /WNING 'ROUP 2OLE IN 'ROUP AND 2OLE ACCESSORS

s 7HEN THE !-?02/*%#4?-/$% PREFERENCE IS SET IT AFFECTS THE

EVALUATION OF THE 2OLE IN 0ROJECT AND 2OLE IN 0ROJECT OF /BJECT
ACCESSORS

3/0 . !CCESS -ANAGER 'UIDE