Set Rights › How Rights Work in BusinessObjects Enterprise › Determine Effective Rights

Determine Effective Rights

Keep these considerations in mind when you set rights on an object:

• Each access level grants some rights, denies some rights, and leaves the other rights unspecified. When a user is granted several access levels, the system aggregates the effective rights and denies any unspecified rights by default.
• When you assign multiple access levels to a principal on an object, the principal has the combination of each access level's rights. The user in “Multiple access levels” is assigned two access levels. One access level grants the user rights 3 and 4, while the other access level grants right 3 only. The effective rights for the user are 3 and 4.

  

• Advanced rights can be combined with access levels to customize the rights settings for a principal on an object. For example, if an advanced right and an access level are both assigned explicitly to a principal on an object, and the advanced right contradicts a right in the access level, the advanced right will override the right in the access level.

  Advanced rights can override their identical counterparts in access levels only when they are set on the same object for the same principal. For example, an advanced Add right set at the general global level can override the general Add right setting in an access level; it cannot override a type-specific Add right setting in an access level.

  However, advanced rights do not always override access levels. For example, a principal is denied an Edit right on a parent object. On the child object, the principal is assigned an access level that grants him the Edit right. In the end, the principal has Edit rights on the child object because the rights set on the child object override rights that are set on the parent object.

• Rights override makes it possible for rights set on a child object to override rights that are inherited from the parent object.