Manage User Roles and Privileges > Managing data access rules > Defining data access rules
  

Defining data access rules

Before you define a data access rule, ensure that you have set the required privileges for the custom user roles. If you rename a custom user role in Administrator, the data access rule isn't valid for the user role.
You can create and publish up to 50 record-level and 50 attribute-level data access rules for a business entity.
For more information about the limits on data access rules, see Limits on data access rules.
To define a data access rule, perform the following steps:

Step 1: Select the asset to protect

You can create a data access rule to protect an asset, its attributes, and the user roles to which you want to apply the rule.
    1Click Security > Data Access Rules.
    2Click Add Data Access Rule.
    The New Data Access Rule page appears.
    3Enter a unique name and a description for the data access rule.
    For more information about the guidelines to add name and description for data access rules, see Rules and guidelines for adding rule name and description.
    4Select an asset to protect. Currently, you can only protect business entities.
    5Select one of the following permissions for the selected asset:
    6In the Affected User Roles section, click Add User Role, and select the user roles to which you want to apply the data access rule.
    The Add User Roles page appears.
    7Select the user roles, and click Add.
    The selected user roles are added to the Affected User Roles section.
    8Click Next.
    The Conditions page appears.

Rules and guidelines for adding rule name and description

Consider the following rules and guidelines when you add the data access rule name and description:

Step 2: Configure the rule conditions

Define conditions based on which rules must be applied. You can define conditions based on attributes and field group values that are configured as searchable.
You can configure conditions for the following assets and attributes:
Note: The more the conditions, the longer it takes to process search requests. If you have performance issues after adding conditions, consider reducing the number of conditions.

Configure rule conditions for business entity attributes

You can create conditions only for business entity attributes that you configure as searchable.
    1On the Conditions page, select the level to which you want to apply the rule in the Rule Applies To: list.
    2If you select Attribute Level, select the attributes you want to protect.
    3To set permissions in data access rules, enable the Create, Read, Update, or Delete actions.
    The following image shows the actions that you can enable when you configure a data access rule:The page shows the create, read, update, and delete actions that you can enable in the data access rule.
    4To add conditional statements, enter the required details in the Condition Details section.
    5In the Asset Type list, select Business Entity to create conditions for attributes of the protected business entity or attributes of the business entity related to the protected business entity through the business entity record field.
    Note: The conditions on attributes of related business entity in the business entity record field controls access to these attributes in the record details page and the related records component in your business application.
    Effective in the February 2023 release, the option to create conditions for the following assets and attributes is available for preview:
    You can create conditions for the following assets and attributes:
    Preview functionality is supported for evaluation purposes but is unwarranted and is not supported in production environments or any environment that you plan to push to production. Informatica intends to include the preview functionality in an upcoming release for production use, but might choose not to in accordance with changing market or technical circumstances. For more information, contact Informatica Global Customer Support.
    6Select an attribute, and an applicable operator, and then enter a value. For more information about the supported operators, Operators.
    The conditional statement is listed in the Conditions section.
    7To add another condition, click Add a condition and repeat the steps 3 to 5.
    8Click Save.
    When you save the data access rule, the rule is saved as a draft after creation.
    9To review and publish draft data access rules, on the Data Access Rules tab, click Publish Drafts.
    For more information about reviewing and publishing data access rules, see Reviewing and publishing data access rules.

Configure the rule conditions for relationships

You can configure conditions for relationships, relationship attributes, and related business entity attributes.
Effective in the February 2023 release, the option to create conditions for the following assets and attributes is available for preview:
Preview functionality is supported for evaluation purposes but is unwarranted and is not supported in production environments or any environment that you plan to push to production. Informatica intends to include the preview functionality in an upcoming release for production use, but might choose not to in accordance with changing market or technical circumstances. For more information, contact Informatica Global Customer Support.
    1On the Conditions page, select the level to apply the rule in the Rule Applies To: list.
    2If you select Attribute Level, select the attributes you want to protect.
    3To add conditional statements, enter the required details in the Condition Details section.
    4In the Asset Type list, select Relationship to create conditions on relationships associated with the protected business entity and the relationship attributes.
    5Select a relationship that's associated with the protected business entity in the Relationship Name field.
    The Direction field that shows the relationship direction and the Condition list appears.
  1. 6Select one of the following conditions:
    2. 7Select an attribute for one of the following conditions:
    Note: The Exist and Does Not Exist conditions do not require an operator and value.
    After you specify all the required details, the condition is listed in the Conditions section.
    8To add another condition, click Add a condition and repeat steps 3 through 6.
    9Click Save.
    When you save the data access rule, the rule is saved as a draft after creation.
    10To review and publish draft data access rules, on the Data Access Rules tab, click Publish Drafts.
    For more information about reviewing and publishing data access rules, see Reviewing and publishing data access rules.

Operators

The list of operators varies based on the type of attribute.
The following table lists the operators that you can use in the conditions within data access rules:
Attribute Type
Operator
Boolean
  • - equals to
  • - not equal to
Date
  • - date equals to
  • - date is not equal to
  • - date greater than
  • - date lesser than
  • - date greater than or equal to
  • - date lesser than or equal to
  • - date between
Date and Time
  • - date equals to
  • - date is not equal to
  • - date greater than
  • - date lesser than
  • - date greater than or equal to
  • - date lesser than or equal to
  • - date between
Decimal
  • - equals to
  • - not equal to
  • - in
  • - not in
  • - exists
  • - not exists
  • - greater than
  • - lesser than
Double
  • - equals to
  • - not equal to
  • - in
  • - not in
  • - exists
  • - not exists
  • - greater than
  • - lesser than
Integer
  • - equals to
  • - not equal to
  • - in
  • - not in
  • - exists
  • - not exists
  • - greater than
  • - lesser than
Text
  • - equals to
  • - not equal to
  • - starts with
  • - ends with
  • - in
  • - not in
  • - exists
  • - not exists
  • - contains
  • - does not contain
Picklist
  • - equals to
  • - not equal to
  • - in
  • - not in
  • - exists
  • - not exists