How to configure unique permission at entity level without impacting other entities?

[dave8]

Hello,

I have an entity called "Products" that needs unique permission for that specific entity ONLY without impacting access level of other entities.

Should I create new security role and update access level of all entities including "Products" entity? Or I should update the existing role ( CDS User) by updating access level of only "Products" Entity? OR there is some other way?

Would you please clarify the best practice/approach here?

Thanks and Regards,

[EricRegnier · Accepted solution]

Hi @dave8,

I usually leave the out-of-the-box (OOB) roles intact and create custom roles based on them. So I create a custom role by copying an OOB role and then make the necessary changes. Also inline with this tip: https://crmtipoftheday.com/1297/base-your-base-role-on-the-cds-user-role/

Hope this helps!

[jlindstrom · Accepted solution]

Besides what I said in the tip of the day, I would look at the scope of this requirement--does it apply the same way to all users or is it different for different types of users? For example, do you have three groups that need three different levels of permissions for products? 

Put the minimum permission for product in the base role that all users get, then create additional roles for each other persona with different level of product access.

Put as much as you can in the base role, then the other roles should only contain the delta (what is different).

Remember that CDS roles are cumulative, so if you give them the base role and another role with higher permissions for products, then they get the combination of the two.