The user who creates a record automatically becomes its owner. Only the record owner can modify group account policies in the access form. All other users don’t have write permission for the access permission definition.
If an owner restricts their own permissions for a record, these restricted permissions are valid with one exception: While the owner is not allowed to modify or delete a record blocked for him, she or he can still read it.
Note: When a record is copied, the account policy of the source record is not copied. The access permissions of the record copy can be changed only by its new owner, i.e. the person who created the record copy.
If no read permission is granted for records, the user can only see the corresponding entries in forms and lists as asterisks (*****) in the subject.
Admin: To avoid that such records collide with the maximum number of loadable records in the mask, the variable PSC_VIS_ACC = n can effect that records without read access are not sent to the client and are not displayed there. The additional variable PSC_VIS_ACC_DTO can be used (value n) to not load non-readable records at all. The variable only has an effect if PSC_VIS_ACC is set to "n". Therefore, the mask is filled up to its maximum, if a sufficient number of readable records is found.
At the same time, data misuse by end users (as attackers) can be prevented. The administrator can set the variable PSC_VIS_ACC to "n" for security-relevant data. This causes non-readable records that fulfill the current query conditions of the user to not be indicated through asterisks. The "attacker" therefore does not receive any indication of unreadable content as an attack target.