In PiSA cubes, every class, record, field and method has an access attribute for storing a so-called access list. An access list is a comma-separated list of group access keys. It encodes access permissions for user groups (e.g., R100=read permission for group 100). When data is accessed, PiSA cubes first determines the group assignments of the current user. Then it compares it to the group IDs in the access list. If they are identical, the user receives the access defined for their group (e.g., W=write if he belongs to group 200; R=read if he is a member of group 100, but W=write if he is in both groups). If the access attribute is empty, no verification takes place.
The group access keys can encode the following authorizations:
Entry/authorization | Meaning |
|---|---|
Read permission (read) | The record can only be read. |
Write permission (write) | The record can be read and edited. |
Delete permission (delete) | Full access. The record can be read, edited and deleted. |