Security jump-start - ACL rules plugin

The Security jump-start access control level (ACL Rules) plugin is installed automatically on all new instances. Use this plugin to quickly secure multiple system tables and expedite the production launch process for your organization.

This plugin isn’t intended for existing instances, as it may alter security access to tables already in use in a production environment. If an admin strongly desires to install this plugin on an existing instance, you should test it thoroughly in a test instance first. Doing so helps to verify compatibility with the organization’s current implementation.

If an admin is interested in the new ACL rules provided by this plugin, they can manually create one or more in an existing instance, using the list of ACLs as a guideline.

The following ACLs are included in this plugin. Select the icon in a header row to sort that column in ascending or descending order. The Operation key is as follows:

• R=read

• W=write

• D=delete

• C=create

Name Operation Description cmdb_ci WCD asset or itil role required to write/create/delete Configuration Item records cmn_department WD user_admin role required to write/delete Department records cmn_location WC user_admin role required to write/create Location records core_company WD user_admin role required to write/delete Company records kb_knowledge create knowledge role required to create Knowledge records ldap_ou_config RWCD user_admin role required to read/write/create/delete LDAP OU Definition records ldap_server_config RWCD user_admin role required to read/write/create/delete LDAP Server records process_guide WCD admin role required to write/create/delete Process Guide records process_step WCD admin role required to write/create/delete Process Step records sc_category create catalog_admin role required to create Service Catalog Category records sc_category delete catalog_admin role required to delete Service Catalog Category records sc_category write catalog_admin role required to write to Service Catalog Category records sc_cat_item write catalog_admin role required to write to Catalog Item records sc_cat_item delete catalog_admin role required to delete Catalog Item records sc_cat_item create catalog_admin role required to create Catalog Item records sysevent_email_action read all users can read Email Notification records (for subscription purposes) sysevent_register RWCD admin role required to read/write/create/delete Event Registry records sysevent_script_action RWCD admin role required to read/write/create/delete Script Action records syslog RWCD admin required to read/write/create/delete Log Entry records sysrule RWCD admin required to read/write/create/delete Rule records (Email Notifications, Inbound Email Actions, Approval Rules, and so on) sysrule read all users can read Email Notification records for (subscription-based notifications) sys_app_application WCD admin required to write/create/delete Application records sys_app_category WCD admin role required to write/create/delete Application Category records sys_app_module WCD admin required to write/create/delete Module records sys_audit RWCD admin required to read/write/create/delete Audit records sys_dictionary RWC personalize_dictionary role required to read/write/create Dictionary records sys_dictionary.* read personalize_dictionary role can read Dictionary fields sys_documentation delete personalize_dictionary role required to delete Field Label records sys_documentation create personalize_dictionary role required to create Field Label records sys_documentation write personalize_dictionary role required to write to Field Label records sys_gauge RWCD admin role required to read/write/create/delete Gauge records sys_gauge_count RWCD admin role required to read/write/create/delete Gauge Count records sys_group_has_role read itil role required to see Group Role records sys_home WCD itil_admin role required to write/create/delete Welcome Page Section records sys_installation_exit WCD admin role required to write/create/delete Installation Exit records sys_job WCD admin role required to write/create/delete Sys Job records sys_nav_link WCD admin role required to write/create/delete Navigation Link records sys_perspective WCD admin role required to write/create/delete Menu List records sys_portal RWCD admin role required to read/write/create/delete Portal records sys_portal_page RWCD admin role required to read/write/create/delete Homepage records sys_portal_preferences RWCD admin role required to read/write/create/delete Portal Preferences records sys_processor WC admin role required to write/create Processor records sys_properties WC admin role required to write/create System Property records sys_properties_category WCD admin role required to write/create/delete Property Category records sys_report delete roles that can delete Report records (doesn’t restrict deleting through Report UI) sys_report write roles that can write to Report records (doesn’t restrict editing through Report UI) sys_report read users can read their own Report records, those of their groups, and GLOBAL ones (doesn’t affect viewing through Report UI) sys_report read roles that can read Report records (doesn’t restrict viewing through Report UI) sys_reportroles read admin role required to read Report Roles records sys_script WCD admin role required to write/create/delete Business Rule records sys_script_ajax WCD admin role required to write/create/delete AJAX Script records sys_script_client WCD admin role required to write/create/delete Client Script records sys_script_include WCD admin role required to write/create/delete Script Include records sys_security_acl write admin role required to write to Access Control records sys_security_acl_role create admin role required to create Access Roles records sys_security_acl_role delete admin role required to delete Access Roles records sys_security_acl_role write admin role required to write to Access Roles records sys_security_operation delete admin role required to delete Security Operation records sys_security_operation create admin role required to create Security Operation records sys_security_operation write admin role required to write to Security Operation records sys_security_operation query_range   sys_security_operation     sys_security_type write admin role required to write to Security Type records sys_security_type create admin role required to create Security Type records sys_security_type delete admin role required to delete Security Type records sys_status create admin role required to create System Status records sys_status delete admin role required to delete System Status records sys_status write admin role required to write to System Status records sys_template write template_editor role required to write to Template records sys_template create emplate_editor role required to create Template records sys_template delete template_editor role required to delete Template records sys_template read template_editor role required to read Template Roles records sys_ui_action create admin role required to create UI action records sys_ui_action delete admin role required to delete UI action records sys_ui_action write admin role required to write to UI action records sys_ui_action_view write admin role required to write to UI View Action records sys_ui_action_view create admin role required to create UI View Action records sys_ui_action_view delete admin role required to delete UI View Action records sys_ui_policy create admin role required to create UI Policy records sys_ui_policy delete admin role required to delete UI Policy records sys_ui_policy write admin role required to write to UI Policy records sys_ui_policy_action create admin role required to create UI Policy Action records sys_ui_policy_action delete admin role required to delete UI Policy Action records sys_ui_policy_action write admin role required to write to UI Policy Action records sys_ui_script write admin role required to write to UI Script records sys_ui_script delete admin role required to delete UI Script records sys_ui_script create admin role required to create UI Script records sys_user write Users with no role can’t update any user record but their own sys_user_grmember delete user_admin role required to delete Group Member records sys_user_grmember write user_admin role required to write to Group Member records sys_user_group create Only itil and above can create group records sys_user_group write Only itil and above can write to group records sys_user_has_role read itil role required to see User Role records sys_user_role create admin role required to create Role records sys_user_role delete admin role required to delete Role records sys_user_role write admin role required to write to Role records sys_user_role_contains read itil role required to see Contained Role records sys_user_role_contains write admin role required to write to Contained Role records sys_user_token RWCD admin role required to read/write/create/delete User Token records

Note: To learn more about this plugin, see Enable security jump start plugin (ACL Rules) in Instance Security Hardening Settings.