Create new wtpart and Revise access controls

[lgrant]

Hi Everyone,

I am wondering if we can control who can create a wtpart at a given state (In Work), but now allow a larger group of users can can revise to that same Lifecycle but not create at that lifecycle?

We have a solution in adding a new "creation" lifecycle but wondering if we can do the same with access controls.

This is in 10.1

[doehr]

Hi there,

Very, very easily. Within the Policy Administrator system you have the permissions for Create and Revise. Select WTPart (if you use them) then select the state, role and permission you want to set.

Also, to clarify, you say Lifecycle...do you mean State, i.e. new, in work, under review, released? You saying that you have a "creation" Lifecycle is a bit confusing since the Lifecycle is supposed to be the full set of states an object can ever get to...you don't switch an object's lifecycle template after initial release, right?

Daryl

[bsindelar]

I don't think ACLs alone will allow you to accomplish this, as while you would have this bigger group be able to perform the "revise" action on an object in a particular version and state (say, B and "Released"), that same group would need the "Create" ACL granted in order to be able to make rev C, since it is in fact creating a new WTPart (just a new version under an existing master).

I am also assuming you want both the resulting state of the "revise" action AND the initially creating action of a WTPart to be "In Work" (say, the first lifecycle state of the template).

You may be able to try this:

• In a particular context, allow the normal create and revise ACLs to this bigger group as you normally would.
• Place this group in a particular role on the context team.
• Access the "Configure Actions for Roles" action on the team page.
• Clear the tick box on "Create Parts" action for that particular role only.

While I haven't actively tried this, what this should do is take away any context menu actions for "New Part" from this role, but they should still see the "Revise" action, thus accomplishing what you are looking for, if I have understood your ask correctly.  You can then repeat this for any/all contexts you're looking to accomplish this behavior.

Feel free to reach out to me directly at robert.sindelar@eccellent.com if you have any additional questions.

[lgrant]

Yes, the initial creation state on the Lifecycle is "In Work" and that is used when the wtpart is revised from "Released for Production" (alpha) and (not saying this is a good idea) also "Pre-Released" (numeric).

Bob, I think you are saying to try using a Profile for my wtpart authors (ceraters) so they can create parts. Another profile would be for my CAD authors who would need to modify the parts and revise the parts and that Profile would not have a check for create parts.

Both groups would have create and modify in the access policy for wtparts at "In Work" state.

Using the configure actions for roles seems to be used for the same thing as a Profile but is location based (that Team in that context)?

This seems to work but it does not stop users who should be able to revise from Creating a part from a Document on the Related Objects tab in the Describes Parts. So close to a fix for this...

[satre-2]

Ladric,

I am not sure if I understood your requirement, but it seems like you want restrict part creation Access to only one role (i.e. Designer  )  in INWORK State and you want to give Revise permission to other role in INWORK state ( your lifecycle transition is INWORK object after revision will remain in INWORK state only ).

Since when you revise any object new Revision is created so you need create permission in target state.

In your requirement you want to give create permission to designer and revise permission to more group/role. You can achieve it using ad-hoc permission from LC

1. From Policy administration grant create permission to Designer role and Revise permission to other roles.
2. Edit existing LC and make it Advanced lifecycle and LC’s permission tab grant Create permission to Other roles

Permission from LC will be granted to other roles only after Object is created. So other roles can’t create new object since they don’t have create permission. But when object is created they will ad-hoc permission from LC.

Hope it helps!!!

Thanks

Shreyas

9405954712

[lgrant · Accepted solution]

Interesting. I had not considered using permissions within the LifeCycle.

[lgrant]

Update. This has been working well for us.

We all users to revise on Permissions and then provide create inside the lifecycle to the same role.

This stops everyone from creating parts (other than our few part creators) but allows all necessary roles the ability to revise once the part is create for them.