Oracle Analytics and AI

Ajinkya V

Problem:

In Oracle Fusion Data Intelligence (FDI), can a single user or role be granted differentiated access across subject areas such that the user has Read-only (consume) access to reports built on one subject area, while Authoring/Write access is restricted to a different subject area only?

Concrete example:
We have two subject areas: HCM – Workforce Compensation and HCM – Workforce Core. The required behavior for one user is:

• Can view/consume existing reports built on Workforce Compensation (read-only).
• When authoring (creating or editing workbooks), sees only Workforce Core in the subject-area list.
• Cannot create or modify reports on Workforce Compensation (Compensation must not appear in the authoring picker).

Key question:

Does FDI's security model support this split — read-only on one subject area combined with author/write on another for the same user? If so, how is it configured and enforced (application roles, duty roles, data security, etc.)?

If this split is not natively supported, what is the recommended approach or workaround to achieve subject-area-level authoring restrictions?

JohnW-Oracle

Hello @Ajinkya V ,

No. FDI does not natively support “consume Subject Area A but author only against Subject Area B” for a single user identity. In FDI, authoring is a user-wide capability. If a user has the Author system role, they can create workbooks against every subject area they are permitted to read. The Read-only setting on a subject area means the semantic metadata can be queried; it does not mean “available only when consuming existing reports.”

See the Object Permissions documentation here: https://docs.oracle.com/en-us/iaas/analytics-for-applications/doc/configure-object-permissions.html

and the HCM Duty Role documentation here: https://docs.oracle.com/en/cloud/saas/analytics/26r2/fahia/overview-duty-roles1.html

For example:

OA4F_HCM_COMPENSATION_ANALYSIS_DUTY grants access to the Workforce Compensation subject area.
OA4F_HCM_COMPENSATION_ANALYSIS_CONTENT_DUTY controls access to Compensation-based DV content.
OA4F_HCM_WORKFORCE_CORE_ANALYSIS_DUTY grants access to Workforce Core.
OA4F_HCM_WORKFORCE_CORE_ANALYSIS_CONTENT_DUTY controls access to Workforce Core DV content.

The split between analysis and content duties separates semantic-object access from catalog-content access. It does not separate consumer use from authoring use.

You would need to use separate identities when strict enforcement is required. Give one identity Consumer plus Compensation duties, and the other identity Author plus Workforce Core duties only.