Application and dimensional permissions

Application roles govern broad capabilities. Dimensional policy and tag assignments govern which members a principal can access. Review direct subject access in Users & Security and inspect group grants and rule-specific permissions separately. Security and access guide

Restrict a test Reader to Point A

Use a disposable Operating Data Cube and the direct Reader grant procedure. Prepare distinct read tags DocsPointARead and DocsPointBRead on the corresponding Entity members, and seed both coordinates before applying the policy. The MCP example gives the tag setup and all ten exact policy choices. Dimensional access example

1. As Administrator, choose Read access. In Reviewed dimensional policy, set the ten choices from the example, review them, and choose Save immutable version. Confirm and check that the saved version is available while the policy remains inactive.
2. Choose the exact version in Saved version to activate. Review the saved version and security revision, then choose Activate selected version and confirm. Verify the active version and the new security revision.
3. Use Inspect on the Reader’s grant row. Enter DocsPointARead in Entity assigned read tags and leave the write tags empty for this example. Check the review box, choose Apply reviewed dimensional access, and confirm. The assignment replaces the full read and write tag maps for that subject.
4. Choose Read access again to refresh Application security audit. Open the receipt for the accepted dimension-access.set event and verify its operation ID and payload digest.
5. Verify access in the affected Reader session. With the sample values 10.00000000 at PointA and 20.00000000 at PointB, a bounded read across both points returns the Point A row. A read scoped to Point B returns no rows under this filter policy. Use the Administrator session to confirm that both source rows exist.

On a revision conflict, choose Read access again, reopen the affected subject, and review the full intended assignment against the fresh revision.