View source for Custom Access Criteria

Custom Access Criteria can be used in place of [[Role Based Access Permissions]]. Custom Access Criteria are a set of rules which define the [[Users]] who can perform any of the following Actions on [[Record]]s in [[Objects]]:
:*Add
:*Update
:*Delete
:*List View - defines a typical [[View]]
:*Record View - displays a single [[Record]]
Rules are built by combining User and [[Object]] fields with [[Formula Functions]] to build Boolean [[Expressions]] (which evaluate to ''True'' or ''False''). 
When a rule associated with an action evaluates to ''True'', the user has access to the records and can perform the action.

:''For other uses, see [[Access Control (disambiguation)]].
{{tenantfeatures|}}

==How it Works==
:In an inventory management system, all records in the Inventory Object are visible to everyone (all [[Users]]). However, the operational policy states that only users with a valid ''Cost center code'' for the Purchasing Department can Add, Update, or Delete Inventory records. 

:Although it is possible to design access controls based on standard [[Role Based Access Control]]s, it could become a recurring, complex task; because users and teams are dynamic and change frequently, role- and team-based controls must be updated as the business structure evolves.

:A better solution is to add a '''Custom Access Criteria''', which would act as follows:
:*On an ''add, update or delete'' action for any inventory record, verify that the user record contains a valid ''Cost center code'' from the Purchasing department, then display the records
:*On a ''view'' action (View a record or View a List of records), display the records


{{permissions|Customize Objects|select Custom Access Criteria and build Access Control rules}}

==Add Custom Access Criteria==
To add or edit Custom Access Criteria:
#Click '''Designer > Data > Objects'''
#Select an object
#Click the [Edit] button
#From the Properties tab, ''Access Control'' section, choose one of the following options:
#:;Role Based Permissions:Default
#::*No rules specified, matches {{enterprisebrand}} through V6.2
#::*Enforces Role- and Team-based access control ([[Role Based Access Control]])
#:;Custom Access Criteria:
#::*If selected, ''Role Based Access Control'' is not enforced
#::*Create criteria for any (or all) of the available actions
#In the Custom Access Criteria Builder, complete the following information:
#:*Click the ''Edit'' link to create or edit an action rule:
#::[[File:accesscontrol.gif|none|thumb|Click the ''Edit'' link for each action and add custom access criteria]]
#::[[File:Customaccessrulebuilder.gif|none|thumb|Custom Access Criteria Builder]]
#::[[File:Customaccessrulebuilder-fields.gif|none|thumb|Typical list of fields available in the Custom Access Criteria Builder]]
#::*Note: ''Owner'' and ''Creator'' fields are available as criteria, where ''Owner'' is the [[Record Owner]] and Creator is the [[Record Creator]]
#:::*''Owner'' and ''Creator'' fields are not available in List View or Record View Actions
#Click the [Check Syntax] button to verify that the formula is valid and returns a Boolean value (i.e. True or False)
#:Learn more: [[Expressions#Formula_Expressions|Formula Expressions]]


=== About Building Custom Access Criteria===

Considerations for building Custom Access Criteria:
*If the ''Custom Access Criteria'' option is enabled, then the [[Role Based Access Control]] options are not enforced by default
*If the ''Custom Access Criteria'' is enabled and the action fields are empty, then all users have access to all records for all available actions
*Fields available to build criteria are:
:*Fields in the [[Object]]
:*[[Rollup Summary Fields]]
:*Fields in the [[Users Object]], including [[Users Object#Custom Fields in User Objects|custom fields]]
*For Add and Update actions, the formula is evaluated using the new field values (i.e., values that are part of the add/update action, not the field values in the database prior to the action)

===About Importing Data===
When importing data into an object where [[Custom Access Criteria]] rules are applied, no validations are performed at this time. This means that any data can be imported, regardless of the Custom Access Criteria rules.


<noinclude>[[Category:Features]]</noinclude>
<noinclude>[[Category:Glossary]]</noinclude>