# Data restrictions

## <span class="mw-headline" id="bkmrk-understanding-permis-1">Understanding permissions</span>

Data access is restricted in two ways

- **Mandatory** permissions granting access to 
    - Certain groups of fields (blocks)
    - Records in certain status

- **Optional** filters binding certain data to certain users 
    - Owner user (the user that created the record)
    - List of users (dynamic list of users for each record)
    - Per group (group property)

If a user has no active permissions, they will not have any kind of access to the solution. Filters on the other hand is just considered to be additional restrictions, limiting the access granted by permissions.

In both cases the security restrictions always apply, even during system access, API interaction, integration etc.

## <span id="bkmrk-"></span><span class="mw-headline" id="bkmrk-permissions-%5Bmandato-1">Permissions \[mandatory\]</span>

Permissions to solutions are granted as a sum of multiple permissions.

Each permission contains

- Group
- 0-1 Status (records have status)
- 0-1 Blocks (fields belong to blocks)
- Allow read
- Allow write

Permissions stack in an aggregate like manner, allowing to build complex structures from different fragments. This is also the reason that the Allow read and Allow write properties can be set to empty values (typically for generic permissions).

### <span class="mw-headline" id="bkmrk-differentiated-field-1">Differentiated FIELD level access</span>

Fields belong to blocks. Permissions may be bound to such a block.

A permission with a block specified will ONLY apply to the fields belonging to this block.

### <span class="mw-headline" id="bkmrk-differentiated-state-1">Differentiated STATE level access</span>

Permissions may be bound to a certain status.

A permission with a status specified will ONLY apply to records in this status.

## <span id="bkmrk--1"></span><span class="mw-headline" id="bkmrk-filters-%5Boptional%5D-1">Filters \[optional\]</span>

All ownership options can be overridden by belonging to a certain group, that ignores all types of filters (3 below).

Access to configuration:

Designer &gt; \[solution\] &gt; Security - Filters

### <span class="mw-headline" id="bkmrk-ownership-by-data-ex-1">Ownership by data exclusive group</span>

Designer attribute: Use Exclusive groups for access control

The solution contains a **Exclusive group** that defines a group with access to this piece of data.

- Scope: Group
- Cardinality: One

### <span class="mw-headline" id="bkmrk-ownership-by-data-me-1">Ownership by data member lists</span>

Designer attribute: Use Lists of members for each item

The solution contains a **memberlist** field where users can have their access added or removed. Behind the scenes a table with a relation between the record and the user is maintained.

- Scope: User
- Cardinality: Many

### <span class="mw-headline" id="bkmrk-ownership-by-being-t-1">Ownership by being the creator</span>

Designer attribute: Use Creator only restriction (ignore group recommended)

You must have created this record in order to see access it.

- Scope: User
- Cardinality: One