Security

Decision Center provides a security feature to control access to branches of decision services, and set permission profiles.

You can enable security so that branches of decision services are only visible to certain groups of users. You can enable security in the Business console (see Setting project security), but security applies to both consoles.

When you have enabled security, you must specify, for each group that can access the branch, what permissions they have on artifacts: read only, full authoring, or none. You can set permission profiles from the Business console Administration tab, when you edit a group in the Groups subtab.

Groups are managed by a Decision Center administrator in Decision Center, and users are managed by the administrator in the cloud portal.

Branch security and decision governance

To use the decision governance framework (see Governance principles) with the Decision Center security feature, you must understand how both work and how they interact.

Releases and activities are types of branches, and as such are subject to the Decision Center security and permissions feature. You can enable security on individual branches to define which groups of users have access to them. When security is enabled on a branch, you specify the permissions of groups of users to read only, have full authoring on the artifacts that are contained in the branch, or have no access to these artifacts.

Branches in the decision governance framework inherit the security state of their parent branches. If you enable security on the initial release of a decision service, all the releases and activities that stem from the initial release have security that is enabled by default. Similarly, you can enforce security on a validation activity by setting security on its parent release.

Releases, change activities, and validation activities inherit artifacts from their parent branch, and are subject to permissions. You can, for example, give a group of users security access to a release but restrict their permission to view the change activities of the release.

You can also give or restrict the permissions of a group of users to update the following properties of releases and activities:

Property Used to give or restrict permission to...
Owner Change the owner
Due date Change the due date
Goals Change the goals
Status Proceed to approval, cancel, and reopen
Approvers Add or remove approvers and change their working status
Authors / testers Add or remove authors in change activities or testers in validation activities, and change their working status
The decision governance framework provides governance aspects that are based on states and governance roles:
  • The states of releases and activities (for example, In Progress and Complete).
  • The current user's governance role as a participant in the release or activity (owner, author, tester, approver).

A user who has administrator privileges in Decision Center can do the operations of all the different governance roles. Similarly, users with these privileges have access to all the branches and have all the permissions on all artifacts. However, administrators cannot force state transitions that are not allowed by the decision governance framework.

When you use the decision governance framework, some conditions are imposed, and you must take into account any conditions that are imposed by the security feature. For example, you can rename a release only under the following conditions:
  • The state of the release is not Complete.
  • You are the owner of the release.
  • You have the Update/Release/Name permission on the release, or security on the release is not enforced.