Setting up Access Levels

rbross

After watching the video on Access Levels I still have a few questions!
My app will have 4-5 Access levels:
Administrator( Already created) Used by only the developer as I have been told.
Admin/Supervisor Level for Admin users of the application, I think some call it Super User
or can I just give them the Admin Access Level already defined?
Staff
Volunteer for area X
Volunteer for area Y
The volunteer ares is for different areas of the system so volunteer for area X may see the same as Area Y but area Y cannot see all of what Area X can see. Hope that make sense?

Questions is After createing the new Access Levels do I need to create a BO for each:
Admin/Supervisor Level for Admin users of the application
Staff
Volunteer for area X
Volunteer for area Y
and then add them to the System Users Business group or can I just create them under Access Levels?

Users of this application will all be internal no outside access and will just have certain restrictions on area's of the system they can access and or attributes they can see or modify.
I understand most of this can be managed through the settings in Access levels for each BO as well and the Attributes and Queries VP's and Process etc...

Just want to make sure I get it set up correctly...

Thanks 🙂

kklosson

You should reserve the Administrator access level for the developer and probably create a visual perspective that no System User would ever access. You should separate the concepts of visual perspectives and business objects. You may very well have a unique business object and apply a specific access level to it. But this is not necessary. Potentially, you could just have a RegularUser object and assign each object a different access level. You will also use Access Levels to restrict access to data using Protect actions. Consider that any authorized user can hijack a query and access more data than you want them to have. Protect actions are used to prohibit this. So the Access level defines the visual perspective but rather than defining specific queries for different access levels, you should first apply Protect actions in the rules of your business object. Then, you can potentially have fewer queries and easier configuration management.

rbross

Thank you, that helps and it confirms the direction I was thinking I should go.
Not sure I need to create a BO for an Access Level and add it the the Systems Users Group etc..
I will be creating the users and I am confident that I can control Access to data and attributes using the setting in Access Level Setting and using Protect and Read Protect in rules.
I can copy the Main VP I have and modify it for each Access Level if needed.

Can you set the Access Level on a VP, For Example if I have 4 tabs on a VP but I only want a certain Access Level to see 3 of the 4 tabs can that be done or do I need to create a VP for that Access Level and remove the Tab they do not have Access to?

kklosson

Yes, you can do that. In that scenario, multiple access levels use the same VP and tabs or other items are displayed or hidden based on the access level. Every Access level must have a VP defined for it, but several or all can use the same VP.

rbross

Sound good thanks!