RE: How to restrict access to Data Entities for users
Hi Harry,
Your understanding is incorrect. Let me try to explain it in a different way. When adding an entity to a privilege, you can set access permissions for Read, Create, Update and Delete separately. For each access type, you can have access as: Unset, Grant and Deny. They are listed in priority. Unset would mean that there is no decision taken. Then another security object might have the permissions for access type.
If you have a "view" privilege, you would need to have set Grant for Read and all others should be Unset, not Deny.
For a 'maintain' privilege, you can then set them all to Grant. When a user then as both privileges via the same or different roles, the maximum will be applied which is in case of maintain Grant for all access types.
Only when you would have a security object with Deny permissions, then indeed this has the highest priority and this will ensure that a user will never have the permissions, even when Grant was used.
For your scenario, in this case, you should only work with Unset and Grant.
