Overview

The Access Control Restrictions that may be approved over tasks and rules are discussed below.

Management over Tasks and Rules.

RM restricts access to the actions on Tasks and Rules management in the following way:

  • View Tasks and Rules

    The right to view (and monitor) Tasks without performing management actions (cancel Task, retry Task, enable and fire Rule, delete Task or Rule) is provided to users who are members of the Rule-View(<id>) group. Members of the general parametric role Rule-View(<id>) have view rights on all Tasks and Rules in RM. In addition, users may not have general view rights, but to have view rights on specific Tasks/Rules by becoming members of respective user groups. For example:

    Rule-View(R5K2BIG67XM) is allocated for a Task or Rule with ID R5K2BIG67XM

    Also, users having View permission over a specific Rule, automatically get View-permissions granted for all Tasks launched by that Rule.

    By default, users having the "management" permission for Tasks have the right to view them.

  • Manage Tasks and Rules

    The right to cancel, retry Tasks, enable and fire Rules, delete Tasks and Rules is provided to users who are members of the Rule-Manager(<_id>) group. Members of the general parametric role Rule-Manager(<_id>) have "management" rights on all Tasks and Rules. In additions, the user may not have global management rights, but to have management rights on specific Tasks/Rules by becoming members of respective user groups. For example:

    Rule-Manager(R5K2BIG67XM) is allocated for a Task or Rule with ID R5K2BIG67XM. Also, users having Manager permission over a specific Rule, automatically get Manager-permissions granted for all Tasks launched by that Rule.

    By default, members of the administration group have the "management" right for all operations.

  • Launch Tasks and create Rules

    The right to create Rules and launch Tasks is provided to users who are member of the Rule-Create user group. By default, every user is member of the Rule-Create user group, thus any user is allowed to launch Tasks and create Rules.


Once a Rule is created or Task is manually launched by a User, the system automatically creates a user group Rule-Manager(<newId>) and makes the user who created the entity (Task or Rule) a member of the new group, thus granting him "management" rights on it.

Access Control Restrictions of Executed Tasks

Each created Rule and launched Task keeps in its database the logged in user that has created it.

If a Task is launched automatically by a Rule trigger, then the Rule-creator user is considered to be the Task-launcher.

In this regards, every time a Task executes its Groovy script (Task Action), the execution is done in the user context of the respective Task-launcher user.

This means that:

  • Tasks will involve only devices on which the user possesses manager rights (see the "Access Control" section from Device Management System Architecture).

  • Any API calls within the Groovy scripts will be under the access control policy of the launcher user (i.e., the scripts will be able to access information and perform actions with respect to the access control policy of the respective API functionality being accessed).