ACL configuration for document model

At run time, the library server always checks the user privileges with the ACL.

Each item and item type view has an ACL associated with it. The ACL that must be used for the access control check depends on the ACL binding. At run time, the library server:

• Checks the ACL at item type level when you are creating a document or retrieving item type information. If you access an item type view, the library server checks the ACL of the item type view. However, to retrieve system-defined parts, item type information does not require any ACL or privilege checking. For user-defined part types, the library server must check part type ACL.
• Retrieves the ACL based on the ACL binding to check the ACL and the privileges when you are searching and retrieving a document, updating a document with parts, and for all other run time functions. You can set the ACL binding and the default ACL in the ACL window of an item type definition from system administration client.

The ACL checking for the document and the parts are separate and independent. Therefore, a user might be able to update either the document or the resource parts based on the ACL or the privilege.

Each view is assigned an ACL for an item type. The ACL checking for document parts is independent of the document views. There is no view for document parts. However, it is possible to create views on user-defined part types.

The item type level ACL that the library server uses for the document is set at the Access Control window. For the base view and for other item type views, the ACL is set in the item type subset window of the system administration client.

The ACL is specified in the item type relation for each part type when the document item type is created. The item type level ACL used by library server for the resource parts are from the Document Management window in the system administration client