Idea
Enhance FDI Custom Data Security to allow permitted data values to be configured directly within a Data Role, rather than requiring all values to be granted separately through user-level Security Assignments.
Use Case
Our organisation uses row-level data security based on Chart of Accounts segment values that align to organisational structures.
For example, Retail Finance, Commercial Finance and other Finance teams each have defined sets of segment values to which their users require access.
FDI Data Roles already allow administrators to configure:
- The object being secured.
- The attribute/segment used for security.
- The Functional Group - AND / OR logic between security configurations.
However, the actual permitted values must then be granted through Security Assignments. This creates considerable administration where large groups of users require exactly the same access.
Proposed Enhancement
Add an optional Permitted Values configuration to the Data Role.
For example: Retail Finance Data Security Role
- Security Attribute: Segment 2
- Permitted Values: 12345, 12346, 12347
Any user assigned this Data Role would automatically receive access to these values without requiring separate Security Assignments. Different business roles could therefore encapsulate their complete data access configuration, for example:
- Retail Finance Data Security Role
- Commercial Finance Data Security Role
- Insurance Finance Data Security Role
User access management would then primarily consist of assigning the appropriate Data Role. The existing Security Assignment functionality could remain available for scenarios requiring user-specific access.
Benefits
- Reduced administration: removes repetitive user-level Security Assignments.
- Improved governance: the complete access definition is visible against the Data Role.
- Consistent access: all users assigned the same role receive the same standard access.
- Simpler joiner/mover/leaver processes: changing a user's business role automatically changes their standard data access.
- Better scalability: security is maintained at a business-role level rather than repeatedly for individual users.
- Improved role-based access control: enables organisations to model FDI security around established organisational roles and access boundaries.
In organisations with large user populations, such as mine, this could substantially simplify the ongoing administration of FDI Custom Data Security.
