Object Name specific Access Control rules

[taruchamy]

Dear Experts ,

We want an assembly to be accessed from specific group of people, where we wanted to restrict a specific sub assembly for the users from reading it.

It is known fact that keeping the "restrictive" objects in seperate folder or a different context should address - But I am looking if there any option to store the complete assembly in a single location.

TOP_LEVEL_ASSEMBLY.asm

|

|__ SUB_ASSEMBLY_1.asm

|

|__ SUB_ASSEMBLY_2.asm

|

|__ SUB_ASSEMBLY_3.asm

Rules to be in place :

1) Restrict SUB_ASSEMBLY_1.asm (and its dependents) to be read.

2) Allow SUB_ASSEMBLY_2.asm (and its dependents) for read only.

3) Allow SUB_ASSEMBLY_3.asm (and its dependents) to be read and write.

Appreciate your support on how to approach this requirement.

Thanks

Murthi

[Jason27]

Restrict a specific sub assembly will cost system performace

[taruchamy]

Yes, it is for a short term.

And how to restrict it ?

[anayak-3]

Hi Murthy,

Try using security labels and Agreements.

Security Labels

Security labels are a means to classify sensitive information and restrict access to only authorized users...

Agreements

The agreement authorizes access to objects otherwise restricted by security labels.

Hope this answers your question.

Regards

Avinash Nayak

[BenLoosli · Accepted solution]

A word of caution on Security Labels.

They are complex to set up and modify many system files to enable them. If you make 1 typo when changing the files, your Windchill system will be dead until you find where the issue is and resolve it.

Not sure this is the best method for a short term project to protect a few files.

Move the files that you want read-only access to to a location that only grants read-only access to the files is the easiest. Windchill will still find all of your filoes when you retreive them.

[taruchamy]

Thanks for your responses.

Security labels could be a solution, but hard to manage.

The easier way is always to maintain those in different folder [instead different context for our requirement] and maintain them as a different domains in access.

Thanks 

Murthi