Restricting processing authority

After you have controlled the scope of data a user has access to, you can also control authority within that scope.

Controlling authority allows you to decide what processing actions against the data a given user is permitted. For example, you could give some application programs authority only to read segments in a database, while you give others authority to update or delete segments.

Control processing authority with the PROCOPT parameter

You can control the processing actions of a user through the PROCOPT parameter when you define a program view (PSB). The PROCOPT parameter tells IMS what actions you permit against the database. A program can do what is declared in the PROCOPT.

If your IMS system is enabled to support DDL, the PROCOPT parameter can be specified on the CREATE PROGRAMVIEW statement. If you are defining a program view by using macro instructions for the PSB Generation utility, you can specify the PROCOPT parameter on SENSEG and PCB statements.

Limit program sensitivity to only required segments

In addition to restricting access and authority, you can limit the segments to which an application program is sensitive. The number of sensitive segments and the processing option specified can have an impact on data availability. To achieve maximum data availability, the PSB should be sensitive only to the segments required and the processing option should be as restrictive as possible.

For example, the database definition in the following macro instructions for the DBD Generation utility describes a payroll database that stores the name, address, position, and salary of employees. The hierarchical structure of the database record is shown in figure following the code.

Figure 1. Example database definition for a payroll database
DBD   NAME=PAYROLL,...
DATASET ...
SEGM  NAME=NAME,PARENT=0...
FIELD NAME=
SEGM  NAME=ADDRESS,PARENT=NAME,...
FIELD NAME=
SEGM  NAME=POSITION,PARENT=NAME,...
FIELD NAME=
SEGM  NAME=SALARY,PARENT=NAME,...
FIELD NAME=
⋮
Figure 2. Payroll database record without a mask
Begin Figure. The NAME segment is the root of the database record. Below it are three dependent segments: ADDRESS, POSITION, and SALARY. End Figure.

If an application needs access to the name, address, and position of employees, but not the salary, you can use the SENSEG statement in the DB PCB macro instructions for the PSB Generation utility to make the application sensitive to only the name, address, and position segments. The SENSEG statements on the DB PCB creates a mask over the database record hiding segments from application. The following code shows the DB PCB that masks the SALARY segment of the payroll database from the application.

Figure 3. Example PCB for a payroll database 
PCB TYPE=DB.DBDNAME=PAYROLL,...
SENSEG NAME=NAME,PARENT=0,...
SENSEG NAME=ADDRESS,PARENT=NAME,...
SENSEG NAME=POSITION,PARENT=NAME,...
⋮

If you are using DDL, you can achieve the same result as the preceding macro instruction statements by using the CREATE SCHEMA statement:

Figure 4. Example DDL program view schema for a payroll database 
CREATE SCHEMA pcb01 USING payroll AS pcb01 (
  CREATE SENSEGVIEW name,
  CREATE SENSEGVIEW address,
  CREATE SENSEGVIEW position,
  ⋮
)

The following figure shows what the payroll database record looks like to the application based on the preceding program view definitions. It looks just like the database record in the preceding figure except that the SALARY segment is hidden.

Figure 5. Payroll database record with SALARY segment masked
Begin Figure. The NAME segment is the root of the database record. Below it are only two dependent segments: ADDRESS and POSITION. End Figure.