Configuring role-based redactions for IBM FileNet P8 repositories

Role-based redactions limit a user's exposure to sensitive data based on the user's business role. You no longer need to have multiple versions of the same document for users with different roles. Role-based redactions use policies that define the redactions to apply to a document.

1. Log in to IBM Content Navigator as an administrator and click the Open Administration View icon on the left navigation bar.
2. Enable role-based redactions:
   1. In the navigation pane, click Repositories.
   2. Click New Repository to create a new repository or double-click an existing repository that you want to configure for role-based redactions.
   3. Enter the information in all fields and click Connect to connect to the repository.
   4. Log in again with your user name and password.
   5. In the Optional Features section of the Configuration Parameters tab, enable role-based redactions for the repository and assign redaction policy editors and redaction editors.
   6. Click Save and Close.
3. In the navigation pane, click Role-based Redactions.
4. Define redaction reasons.
   Redaction reasons identify the types of sensitive data that you want to conceal from general users. IBM Content Navigator predefines two redaction reasons for you: Social Security Number and Credit Card Number.
   1. Click New Redaction Reason from the Reasons tab.
   2. Provide a name and optionally, a description, for a type of sensitive data that you want to conceal from general users.
   3. Click Save and Close.
   4. Repeat steps a to c for each type of sensitive data that you want to protect.
      When a redaction reason is specified for use in a document, the Repositories column on the Reasons tab is populated with the name of the repository that holds the document.
5. Click the Policies and Roles tab.

   If only one repository is enabled for role-based redactions, the repository name is displayed at the top of the tab. If you are not already connected to it, connect to the repository.

   If multiple repositories are enabled for role-based redactions, select the repository that you want to configure. If you are not already connected to it, you are prompted to do so.

   Note: Only repositories that are enabled for role-based redactions appear in the Repositories list.
6. Create redaction roles.
   Redaction roles designate which users and groups can view sensitive content and which users and groups can modify role-based redactions. They obscure or permanently remove sensitive content from view by general users.
   1. From the Policies and Roles tab, click New Redaction Role under the Redaction Roles Configuration section.
   2. Provide a name and optionally, a description, for the role.
   3. Identify the type of role that you are creating, Editor, or Viewer.
      Redaction editors can create, modify, or delete specific types of role-based redactions. Redaction viewers can view specific types of sensitive data.
   4. Assign users and groups to the role.
      Note: For each role member, you can allow or deny access for that member. For example, you might add the Finance Department group to a viewer role and then deny access to the Finance Department intern by adding an intern separately and selecting Deny from the Access list.
   5. Click Save and Close.
   6. Repeat steps a to e for each role.
7. Create redaction policies.
   All role-based redactions on a document are applied to the document by default when it is accessed. The exception to this base rule is managed by using redaction policies. By associating redaction reasons with redaction roles, redaction policies identify what role-based redactions are not applied to the documents for viewers that are associated to the policy and what role-based redactions can be created, modified, or deleted by redaction editors that are associated with to the policy.
   1. From the Policies and Roles tab, click New Redaction Policy.
   2. Provide a name and optionally, a description, for the policy.
   3. Select one or more redaction reasons, redaction editors, and redaction viewers.
   4. Click Save and Close.
   5. Repeat steps a to d for each policy.