Provisioning Tool Guide

10.5

Back Next

Node Filter Rules

When you create a node filter for a business entity, you control access to the parent record when the node has no child records. For example, if a customer record has no address associated with it, you might allow users with the DataSteward-Global role permission to view the parent record, but all other data steward roles cannot view the parent record.

Before you create node filters, decide how you want to manage rules. You can define rules in terms of who is denied access, who is allowed access, or both. Familiarize yourself with the behaviors of each approach and create an overall plan. For maintenance purposes, it can be more straightforward to use only one type of rule.

Avoid creating an excessive number of filters. The more filters, the longer it takes to process search requests. If you have performance issues after adding filters, consider reducing the number of filters.

Deny rules only

Deny rules are joined by a logical OR. If you define only deny rules for a node filter, the following behaviors apply:

When a user role is not assigned to any deny rules, the user can see any parent record.

When a user role is assigned to all deny rules, the user cannot see any parent record.

When a user role is assigned to one deny rule, and there is no child record for the node, the user cannot see the parent record.

When a user role is assigned to multiple deny rules, and at least one child record exists that satisfies the rule, the user cannot see the parent record.

When a user role is not assigned to any deny rules, but one or more deny rules have the

Apply this rule

option selected, the user cannot see the parent record if a record satisfies any of these rules.

Allow rules only

Allow rules are joined by a logical AND. If you define only allow rules for a node filter, the following behaviors apply:

When a user role is not assigned to any allow rules, the user cannot see any parent record.

When a user role is assigned to all allow rules, the user can see any parent record.

When a user role is assigned to one allow rule, and there is no child record for the node, the user can see the parent record.

When a user role is assigned to multiple allow rules, and

all

the rules are satisfied, the user can see the parent record.

When a user role is assigned to multiple allow rules, and any of the rules are not satisfied, the user cannot see the parent record.

When a user role is not assigned to any allow rules, but one or more allow rules have the

Apply this rule

option selected, the user can see the record if all the rules are satisfied.

Both deny and allow rules

If you define both deny rules and allow rules for a node filter, the following behaviors apply:

If a user role is not assigned to any deny rules or allow rules, the user cannot see any parent records.

If a user role is assigned to one or more deny and allow rules, and a record satisfies any of the deny rules, the allow rules are ignored and the user cannot see the parent record.

If a deny rule is not satisfied, the allow rules are processed as described in the

Allow rules only

section.