Administer Advanced CA EEM Security › Customizing User Access with CA EEM Policies › Default Resource Classes and Custom Policies

Default Resource Classes and Custom Policies

CA Process Automation Resource Classes are listed under Access Policies in CA EEM. You can create an original custom policy for any resource class or base it on a predefined policy.

Most of the CA EEM resource classes include predefined policies.

You can use Save As to save the predefined Access Policies with a new name, and then customize as necessary. Creating a custom policy that is based on a predefined policy helps you achieve the following results:

• Provide the assigned group a permission that the predefined policy does not grant. For example, the custom policy can grant the Designers group access to the Configuration tab Installation palette so that they can install agents.
• Remove a permission or access that a predefined policy grants. For example, your custom policy can remove PAMUsers group access rights to the Reports tab.
• Replace a default group (for example, PAMAdmins), with groups that better reflect the product roles that your site defines. For example, you can have three administrator levels instead of one. Assign PAMAdmins to your Domain administrator and create separate administrator groups that administer content and perform configurations for each environment.

  Note: For more information about creating separate access rights for Content Administrators and Configuration Administrators, see Create User Accounts with Custom AD Roles.

• Add one or more filters for fine-grained access. For example, you can specify ENVIRONMENT equal to an environment name as a filter. The environment filter is often used in user-defined Touchpoint Security policies.

Consider the process and start request form objects in terms of the SOAP access level calls through web services. When you create a policy with the Process resource class, you grant specified users or groups Process Start (Start) or Process_Control (Control) rights. If the user who invokes the Execute Process method has the Start permission or the Control permission, the method runs successfully. When you create a policy with the Start Request Form resource class, you grant specified users or groups StartRequestForm_Start (Start) or StartRequestForm_Dequeue (Dequeue) permissions. If the user who runs the Execute Start Request Form method has the Start permission or the Dequeue permission, the method runs successfully. If the user who runs the method does not have execute rights on the target object, the method fails. The SOAP operator dataset records method failure messages.

You can create a custom CA EEM policy that grants or denies access by specified groups to any specified automation object. For example:

• Limit access to a specified environment with the Agenda, Dataset, System, Process, Resources, Start Request Form, and Touchpoint Security policies. Add a filter where Environment is the named attribute and your environment name is the value. The STRING Operator is EQUAL ==. In the following filter example, Test is the Environment name:

  

• Limit access to a specified folder or object with the Object policy. Add a resource such as /folder_name or /folder_name/object_name. In the following example, /folder_name represents the name of the folder where the automation object resides.

  

You can also create a custom policy for the Object resource class. Policies on Object provide a filter to specify the object type to which the policy applies. Add a filter where the named attribute is Object Type and the value is an object type. The STRING Operator is EQUAL ==. In the following filter example, Resources is the Object Type name:

Other valid values include:

• The resource classes:
  • Agenda, the resource class for Schedule.
  • Dataset
  • Process
  • Resources
  • Start Request Form
• Calendar
• Custom Icon
• Custom Operator
• Folder
• Interaction Request Form
• Process Watch