Security Permission Pools

A permission pool is a collection of permissions that a specific user category can be authorised with. For example, any user who has not logged in falls into the "Guest user" category and therefore inherits all permissions from the "Guest user" permission pool. There are two types of permission pools – "user type" permission pools and "entity relationship type" permission pools:

• “User type” permission pools define access permissions of a guest user (who has not logged in), an external logged in individual user and an external logged in organisational users. Verne determines if a user is eligible for a “user type” permission pool when user session is created. For example, a non-logged in user is granted a suite of permissions from the guest user permission pool that allows them access to public searches and viewing of companies, professionals etc. Likewise, an external user is granted a suite of permissions from the external user permission pool that allows them access to public searches, view services as well as registration services.
• “Entity relationship type” permission pools contain permissions that allow a user to access data and services of a specific entity that a user has relationship with. “Entity” could be a user profile, an organisation profile, an entity on the business register, etc. Each relationship type contains different permissions that reflect responsibilities associated with it. For example, relationship type “company director” will be associated with its own permission pool that contains permissions to allow viewing of company private data, filing entity documents and managing access of other users to this company. Verne determines if a user is eligible for an “entity relationship type” permission pool every time user starts a business service on a specific entity.

Internal users do not have a "user type" permission pool, as internal user’s permissions must be granted via permission groups. Internal users inherit only one entity relationship permission pool – "user profile owner", that allows them to view and manage their own access profile.

A permission pool has the following attributes:

• Code – a unique code for the permission, e.g. P011
• Name – name of the permission, e.g. Edit form
• Description – descriptive text explaining the permission
• Status – indicates if the permission is active or inactive, e.g. active

All permission pools are stored using the same mechanism as all other data, via service transactions, with a current activated version and previous versions of the data.

The Domain Tree for a permission pool is as follows:

{
  "_id": "<unique_domain_id>",
  "name": "PermissionPool",
  "attributes":{
    "Code":"PP01",
    "Name":"Guest user",
    "Status":"active",
    "Description":"Guest user inherits all permissions listed in this pool as well as access associated with permission U001 Guest user"
  },
  "permissions":[
    {
      "_id":"<unique_domain_id>",
      "name":"Permission",
      "arrName":"permissions",
      "attributes":{
        "SystemName":"PERM_COP001_ACCESS_PUBLIC_DATA_COMPANY"
      }
    }
  ]
}

Notes:

1. The permissions array contains 0 or more Permission domains linked via the SystemName of that permission.