Knowledge Document: A Hybrid Design Pattern for Criteria-Based Access Control

Hello everyone,

As many of us are transition from legacy RBAC to Redwood's Criteria-Based Access Control (CBAC), navigating Oracle's strictly additive security model can be tricky. Because a "Hide" restriction in one rule can never override a broader "Grant" in another, it is very easy to accidentally over-grant access and expose sensitive Intellectual Property (like proprietary BOMs or formulations) when layering multiple roles.

During a recent enterprise PLM migration, I implemented a Two-Tier Hybrid Security Pattern to solve this:

• Layer 1 (Global Baseline): We delegate universal view access to a baseline team, but explicitly exclude sensitive attribute groups (like BOM Structures) on restricted Item Classes.