Advanced Cloud Security Documentation
Index

Security Assignment Overview

Phase 3 of Advanced Cloud Security focuses on assigning security features to users. This phase determines who receives which security rules in your organization.

What is Security Assignment?

Security assignment connects:

  • Security Features (defined in Build phase)
  • Users, Groups, or Permission Sets (who should be secured)

Until you assign a security feature to someone, it has no effect.

Assignment Methods

ACS provides three ways to assign security features:

Method Description Best For
User Assignment Assign directly to individual users Specific user needs
Security Group Assignment Assign to BC security groups Role-based security
Permission Set Assignment Assign alongside permission sets Permission-aligned security

How Assignment Works

User Logs In
     ↓
ACS Evaluates Security
     ↓
Checks: Direct User Assignments
        + Security Group Assignments  
        + Permission Set Assignments
     ↓
Combines All Features
     ↓
Applies Effective Security

Scope of Security Assignment

Security assignment is configured per company:

Aspect Scope
User assignments Per company
Group assignments Per company
Permission set assignments Per company
User filter values Per company

This allows different security in different companies.

Phase 3 Components

Component Purpose
Assign to Users Direct user-to-feature assignment
Assign to Security Groups Group-based assignment
Assign to Permission Sets Permission-set-based assignment
User Filters Configure dynamic filter values
Effective Security View combined security for a user

Understanding Effective Security

A user's effective security combines all sources:

Example

User: JOHN.DOE

Source Security Features Assigned
Direct HIDE-COST
Security Group "Sales" SALES-EU-FILTER
Permission Set "SALES" READ-ONLY-INVENTORY

Effective Security: HIDE-COST + SALES-EU-FILTER + READ-ONLY-INVENTORY

All three features are applied to this user.

Assignment Priority

When the same field/action is controlled by multiple features:

Scenario Result
One feature hides, another shows Hidden wins (more restrictive)
One feature allows edit, another makes read-only Read-only wins
Different data filters Combined with AND

ACS uses the most restrictive setting when there's a conflict.

Workflow for Assigning Security

Step 1: Plan Assignments

Before assigning:

  1. List the security features you've created
  2. Identify who should have each feature
  3. Decide on assignment method(s)

Step 2: Choose Assignment Method

If... Then use...
Specific users need specific features User assignment
Security aligns with BC security groups Security group assignment
Security aligns with permission sets Permission set assignment
Complex requirements Combination of methods

Step 3: Configure Assignments

  1. Open the appropriate assignment page
  2. Select the user/group/permission set
  3. Add security features

Step 4: Configure User Filters

If using dynamic data filters:

  1. Open User Filters
  2. For each user, enter filter values
  3. Test filter behavior

Step 5: Verify

  1. Open Effective Security
  2. Select a user
  3. Verify they have the expected features
  4. Test with actual pages

When to Use Each Method

Use User Assignment When:

  • Individual users have unique requirements
  • Security doesn't follow group patterns
  • Small number of users to manage
  • Quick one-off assignments

Use Security Group Assignment When:

  • You already use BC security groups
  • Security aligns with organizational roles
  • Multiple users need the same features
  • Easier ongoing management

Use Permission Set Assignment When:

  • Security features should follow permissions
  • Users with certain permissions get certain security
  • Aligns with your permission strategy
  • Automatic when permission sets change

Use Combination When:

  • Complex organization structure
  • Base security via groups + exceptions via user
  • Different features from different sources

User Filter Values

For dynamic data filters (using filter codes like UF_23 for Location Code):

  1. Each user needs their filter value configured
  2. Values are stored per company
  3. Filters use these values at runtime

Example

Feature "SALES-REGION" has filter:

  • Customer."Salesperson Code" = filter code UF_21 (Salesperson/Purchaser Code)

User filter configuration in User Security Filters:

User Salespers./Purch. Code
JOHN.DOE JOHN
JANE.SMITH JANE

John sees only customers with Salesperson = JOHN

Testing Assignments

Using Effective Security

  1. Open Effective Security
  2. Select a user
  3. Review all assigned features
  4. Verify sources (user/group/permission set)

Manual Testing

  1. Log in as the user (or use "Test Security" feature)
  2. Navigate to affected pages
  3. Verify fields are hidden/read-only as expected
  4. Verify data is filtered correctly

Multi-Company Considerations

When working with multiple companies:

  1. Switch to each company
  2. Configure assignments for that company
  3. User filter values may differ by company
  4. Test in each company

Best Practices

Start with Groups

  • Use group-based assignment as the foundation
  • Add user-specific exceptions as needed
  • Easier to maintain over time

Document Assignments

Keep records of:

  • Why each assignment exists
  • Who approved the assignment
  • When assignments should be reviewed

Regular Reviews

  • Review assignments quarterly
  • Remove obsolete assignments
  • Update as roles change

Test Thoroughly

  • Test with actual users
  • Verify all affected pages
  • Check edge cases