Users & Security and Administration

Use Users & Security for application access. Use Server Administration for the native identity directory and Administration for controls scoped to the selected application. Native users and groups

Grant and verify a direct Reader role

Use a disposable Operating Data Cube, an application Administrator, and a separate enrolled test subject. For this example, choose a test subject with no other application access through workspace roles or group grants. Use the subject’s verified ID, such as reader in the fixture.

1. As Administrator, open Users & Security and choose Read access in Application users and roles. Check the selected application, existing role rows and active policy.
2. Under Reviewed application access, enter Verified subject, choose Grant or update and role Reader. Check I reviewed this exact identity, action and role, choose Apply reviewed access, and confirm the dialog.
3. Verify the Reader row. In Application security audit, find the accepted application.grant event and open its receipt correlation. Verify the operation ID and the committed receipt.
4. Open the application in a separate session as the test subject. Read the allowed sample in Grid. Users & Security is absent for the Reader. To verify a dimensional restriction too, follow the Point A and Point B example.

Remove the test grant

In the Administrator session, choose Revoke for the same verified subject, review and apply. Confirm the row is gone and open the application.revoke receipt. In the affected test session, repeat the scoped read. With this example’s direct grant removed, the application rejects the request. The audit can be downloaded with Export complete CSV. Its actor and target columns contain digests.