To get started, you need to understand the various types of access to resources (objects and operations) that IDD users will need in your IDD application.

In SAM, the

role

is the core mechanism that determines how much access a user has to IDD resources. SAM is highly configurable and provides granular control over resources. Consider creating a separate role for each unique combination of objects/operations access, and assign privileges to that role. Roles can be based on other roles to create layers of expanding privileges. Once configured, you assign users to the role best suited to their job responsibilities.

This example scenario follows the principle of

least privilege

- access to resources are granted on an as-needed basis. By default, users have no permissions. You then selectively grant users only those permissions that are required to complete the operations for which they are responsible.