Document Processing security and roles

The security model defines the roles and permissions for managing access to captured and classified documents.

The security model for Document Processing encompasses the following elements:

  • The types of roles used by the project.
  • The access that is granted by each role in the design environment.
  • The access that is granted by each role in the application environment.
Implementation of roles
A document processing user must authenticate with the IBM Cloud Pak® Platform UI (Zen) service and the user's Business Team membership determines their roles. Each document processing role is manifested as a business team. Authorized users can use the Team server user interface to update relevant teams' membership to grant users access to work on various tasks. The Cloud Pak for Business Automation Operator for the IBM Automation Document Processing pattern adds a user as an environment owner to the Business Teams Service (BTS) Administrators team and to the Doc Processing Manager team. The user can start the process of populating other teams or roles as needed. Document processing business teams or roles fall into the following three scopes:
Cross-project roles
  • Cross-project roles are created by the operator when an environment is deployed, and they have access to assets across all projects in the document processing application:
    • Doc Processing Service Accounts: Functional accounts used by Document Processing services only. These accounts cannot be used to access any user interface.
    • Doc Processing Managers: Administrators for both design and runtime Document Processing services, can create, modify, deploy and delete projects and all of their artifacts, and control access to any project.
    • Doc Processing Analysts (created in authoring environment): Business analysts who can create, and develop projects, and deploy projects in the authoring environment. This role has no access to the runtime environments.
Project scoped roles
Project scoped roles are created in the design environment when a new project is created in BA Studio and in the runtime environment (Document Processing Time and Business Application environments) by the Content Project Deployment Service when a project version is deployed for the document processing application. Project Admins can modify, deploy, and delete the project that they administer. Classification workers exist only in the runtime environment and can classify documents in Content Platform Engine.
  • Project Admins-<projectName>
  • Classification Workers-<projectName>
Project-scope and Class-scope roles
Project-scope and Class-scope roles for finalized documents roles - are created by Content Project Deployment Service when you deploy a selected Document Processing project version in authoring or in runtime (test/staging/production) environment. They are created for each document class that is defined in a project version. These roles have access to finalized Content Platform Engine documents for business application.
  • One team per project:
    • Business Owners-<projectName>
    • Document Owners-<projectName>
    • Document Editors-<projectName>
    • Document Viewers<projectName>
  • One team per class in the project:
    • Document Owners-<projectName>-<documentTypeName>
    • Document Editors-<projectName>-<documentTypeName>
    • Document Viewers-<projectName>-<documentTypeName>
Use of Roles in Document Processing environments

IBM Automation Document Processing has a design environment (where analysts design the project), a processing environment (where documents are captured and processed by document processing workers) and a business application environment (where users use the documents in a business application). The roles that are defined in this model control access to the project in the design and runtime environments, and provide the default security for the documents that are created by an IBM Automation Document Processing application, in the business application. The following table shows where each role is used.

Table 1. Use of roles
Role / Environment Design Processing Finalized documents
Doc Processing Service Accounts Yes Yes No
Doc Processing Managers Yes Yes No
Doc Processing Analysts Yes   No
Project Admins Yes Yes No
Classification Workers No Yes No
Business Owners No No No
Document Owners No No Yes
Document Editors No No Yes
Document Viewers No No Yes
Design Environment

The following data is maintained for a project in the design environment.

  • Project ontologies and machine learning models are stored in the design Document Processing project. Document Processing enforces access to this data, by using the three design roles.
  • Project definition files that define what are deployed to the application environment are stored in the project’s Git repository. The IBM Automation Document Processing Repository API service enforces access to this data, by using the three design roles.
Document Processing Time Environment

Classification workers have permission to create, update and manage the in-progress documents, complete the process of classifying and extracting property values, and saving the finalized business documents. The following data is maintained for a project in the Document Processing environment.

  • The runtime Document Processing project stores input documents in both their original and PDF formats, as well as the JSON representing the data extracted from these documents by the classification and extraction process. Document Processing enforces access to this data, by using the three Document Processing time roles.
  • The runtime Content Engine object store holds the captured documents in their intermediate form, while the capture application process is in progress. These documents are processed by classification workers by using the capture application. Content Engine enforces access to these intermediate documents, by using the three Document Processing time roles.
Business Application Environment
The finalized documents are used in the customer’s business applications in the same Content Engine object store that Document Processing occurs in. The design and Document Processing roles have no access to these finalized documents. A different set of roles is instead defined for the business users accessing the finalized documents. Content Engine enforces access to these finalized documents, by using the three per-project business roles, and the three per-document class business roles.
Content Engine Role objects

Within the application environment, the Content Project Deployment Service creates a set of Content Engine role object that control access to both the capture time documents, and the finalized business application documents.

The role-based access is accomplished with a combination of static and nested dynamic roles. The dynamic roles correspond to the various teams and so the membership of these roles are determined by the teams. The static roles provide flexibility in allowing role membership to be defined statically on the role objects. In IBM Automation Document Processing it is recommended that role membership must be modified through the teams. For the finalized document classes, default access is controlled by the default instance permissions set on the document class. This includes role permissions that are associated with the static and nested dynamic roles making up the per-project and per-document class business roles.
Note: The Content Engine Role objects that are added by IBM Automation Document Processing are managed by IBM Automation Document Processing and should not be modified.