Administration Guide › Policies › Introduction to Policies

Introduction to Policies

An access policy is a rule that grants or denies an identity (user or user group) access rights to an application resource or a global resource. CA Enterprise Log Manager determines whether policies apply to the particular user by matching identities, resources, resource classes, and evaluating the filters. That is, a policy states the actions that are granted or denied to specific identities on specific resources. Policies that deny access to a given resource have precedence over policies that grant access to the same resource.

CA Enterprise Log Manager supports the following types of access policies:

• CALM Access policies
• Delegation policies
• Dynamic User Group policies (an alternative approach to custom application groups)
• Obligation policies (created automatically when you create an access filter)
• Scoping policies

CA Enterprise Log Manager is installed with predefined CALM access policies and scoping policies for three CA Enterprise Log Manager application user groups: Administrator, Analyst, and Auditor. These policies are sufficient if you plan to assign only the out-of-the-box application user groups to users performing the various roles.

Important! We recommend that you take a backup of the predefined policies that are provided with CA Enterprise Log Manager. If a CALM Access policy is inadvertently deleted, users cannot access CA Enterprise Log Manager until that policy is restored from a backup.