Including Privileges
Understanding Privilege Inclusion
Privilege inclusion stands as a foundational concept in access control, involving the nesting of one or more privileges within another to create a hierarchical structure. This approach enables the inheritance of permissions, simplifying the management of access rights.
Benefits of Privilege Inclusion
Privilege inclusion provides substantial advantages, enhancing the efficiency and flexibility of access control:
Benefits | Purpose | Practical Application |
---|---|---|
Granular Control | Empowers administrators for precise user access control. | In a healthcare system, it's used to manage access to patient records with healthcare providers granted access to only relevant medical information, ensuring fine-tuned control over sensitive data. |
Efficient Management | Hierarchical privileges reduce redundancy in permission assignments. | In large enterprises, it's used to set overarching permissions for departments or roles. For example, a marketing team might inherit common access rights without individual configurations. |
Flexibility and Adaptability | Enables a flexible and adaptable access control model. | In a rapidly evolving technology company, it's used to integrate access rights for new tools without disrupting existing configurations. |
Nuanced Access Restrictions | Allows for nuanced access restrictions. | In a financial institution, it's used to enforce specific access restrictions for different departments. For instance, the finance team might have additional access rights to sensitive financial data, while other departments have restricted access. |
Including Privilege Use Case
Background
The ManageReports
privilege grants the Sales Manager
role access to the Reporting
dataclass, with the exception of the delete permission:
![](/docs/assets/images/IncludePrivilege1-6c123cd64ad773689b48e3f97bee5a16.png)
However, the addition of the ManageFinancials
privilege introduces specialized restrictions for anyone outside the financial department, including access to netProfitMargin
and totalExpenses
attributes and deletion permissions within the Reporting
dataclass:
![](/docs/assets/images/IncludePrivilege2-d0cf839b60a69d855f40ef766169eae9.png)
Intra-Privilege Relationships
In a Financial Manager
role, two privileges exist: ManageReports
for reviewing and creating reports, and ManageFinancials
for deleting reports or accessing sensitive data.
In this case, the ManageFinancials
privilege operates within the constraints set by the ManageReports
privilege, adding supplementary permissions, ensuring nuanced control over data access.
Given the structured inheritance of permissions, an efficient approach consolidates these into a singular privilege. By including ManageReports
within ManageFinancials
, a unified privilege is formed, providing the Financial Manager
with streamlined permissions.
Including Privilege Configuration
To include the ManageReports
privilege within the scope of ManageFinancials
:
- Start by selecting the
ManageFinancials
privilege - In the interface, you'll encounter a list of tags representing previously created privileges.
- Include the
ManageReports
privilege intoManageFinancials
by clicking thebutton, with removal just a click away using the
button.
![](/docs/assets/images/IncludePrivilege3-fd01245833ab9bc824cc3657cf3ddf88.png)
When a privilege is included within another:
- Its name appears below the initial privilege that included it.
![](/docs/assets/images/listedPrivilege-71fe5f42921f8cd9e8cd71cecb4faace.png)
- The privilege is highlighted in the tags.
![](/docs/assets/images/privilegeHighlighted-63bf281823dc17cfc0403dd8b410e70c.png)
- The
icon indicates that permissions are inherited.
- Hovering over the
icon reveals the privilege from which they are inherited.
![](/docs/assets/images/inherited_hoverModal-c2fd16e256d5a62e7f1b702c57215077.png)
Upon successful inclusion, the ManageFinancials
privilege inherits permissions from its counterpart, the ManageReports
privilege, while retaining the delete permission exclusive to the ManageFinancials
privilege.