FAW HCM Restricted Author Role

Question

Hello,

we are currently setting up the roles and security in Fusion AI Data Platform. We tried to use the

"FAW Licensed HCM Restricted Author Role"

Based on our understanding, this role is intended to support analytics authoring (e.g. analyses and dashboards) on existing subject areas, while restricting more advanced capabilities such as creating new data connections or data sources.

However, during testing we observed that users with this role are still able to access the "Create Connection" option within Oracle Analytics.

We would like to clarify the following:

* Is it expected behavior that users with this role can still see and access the "Create Connection" interface?
* Are the restrictions for this role only enforced when attempting to save or use a connection?
* Should the option ideally be hidden entirely for users with this role?
* Under what conditions (e.g. role inheritance or additional permissions) would a user with this role be able to successfully create a connection?

We want to confirm whether this behavior is expected or if it indicates a configuration issue.

Kind regards

Arindam Sadhukhan-Oracle · Answer

Hi JT_DC_2023,

If the user has only the FAW Licensed HCM Restricted Author Role, seeing Create Connection in the Oracle Analytics UI does not necessarily mean the role is too permissive. In our view, the key question is whether the user can actually save and use the connection. If the connection cannot be saved, then the restriction is still being enforced and the menu option may simply remain visible in the UI. If the connection can be saved successfully, then there is likely an additional inherited privilege or role assignment involved and the effective permissions should be reviewed. At this point, I would treat this as a role/inheritance validation issue rather than assuming the role alone should hide the option.

Regards,

Arindam.

JT_DC_2023 · Answer

Hi Arindam,

for our test, the user was assigned only the FAW Licensed HCM Restricted Author Role, which is why I am raising this question.

At the moment, we do not have other comparable restricted users available for validation.

I will additionally test whether the connection can actually be saved. Based on your response, I understand that the "Create Connection" option is not expected to be hidden in the user interface—please correct me if this interpretation is not accurate.

Best regards,

Arindam Sadhukhan-Oracle · Answer

Hi JT,

* Review the full effective roles for the test user, including inherited roles from groups.

* Compare the user against a known restricted user and a known admin user.

* Test whether the user can actually save a connection, not just open the screen.

* If the user can create connections despite the restricted author role, confirm whether an additional Analytics administration or connection-management privilege is present.

* Regards,

* Arindam.