Application access

A Persona defines how users align with an application in terms of business outcomes. A role defines how users interact with an application in terms of specific Tasks. Roles determine what users can and cannot do within the application. Assigning application users to specific roles enables users to perform their work during Case processing. Assign a user to a role to specify how that user interacts with an application.

For example, in a health care application, patients and doctors must perform different Tasks. Define different roles for patients and doctors so that individual users with the appropriate role specified can see the correct user interface and access the desired application features.

In the following image, click the + icons to explore how Pega Platform™ uses roles to define permissions in an application:

Each role has a default Channel interface that defines which screen a user will see upon logging in. Channel interfaces are also referred to as user interfaces. You can associate roles to Studio Channels (App Studio, Admin Studio, and Dev Studio) and web Channel interfaces (User Portal or an application-specific Channel such as Doctor Portal).

The role-based access control model

Application and data security are major concerns due to risks of customer loss, data breaches, and legal and financial penalties. You can satisfy common security requirements by controlling the application features and functions users can access using role-based access control (RBAC). With RBAC, you configure access by defining roles with the desired authorization and privileges.

Note: Configuring appropriate access control is only one aspect of securing an application. For a complete list of security leading practices, consult the Security Checklist concept for Pega Platform deployment.

RBAC gives a manager access to an application

Access control depends on two factors: authentication and authorization. Authentication confirms the identity of a user and verifies that the user is allowed access to an application. In Pega Platform™, the record for the operator ID allows for authentication of a user. Authorization determines what data the user can view and what Actions the user can perform. In Pega Platform, the records for the Access Group and application allow for authorization of a user.

In the following image, click the + icons to learn more about the records that facilitate authentication:

Access Groups and Access Roles

You can create multiple Access Groups that reference the same application to achieve different levels of access control.

Note: Access Groups in Dev Studio align with the role that developers can assign to users in App Studio.

An Access Role categorizes users according to their job function. Each Access Role represents how a set of users interacts with an application to create and process Cases. For example, in an application for managing purchase requests, any user can submit a purchase request, but only a manager can approve a purchase request.

Each Access Group references one or more Access Roles. By allowing references to multiple roles on an Access Group, Pega Platform encourages the design of a modular application security model in which you combine granular roles to meet complex security needs.

For each Access Role, you configure permissions to control Actions on instances of a specific class, such as the types of Cases that a user can create or modify. If the roles referenced by an Access Group provide conflicting access control configurations, Pega Platform applies the most permissive setting across all the conflicting roles. In the following example, a manager belongs to an Access Group that includes both the User and Manager Access Roles. The Manager Access Role allows users to approve and submit a time-off request, while the User Access Role prohibits approval and submission Actions. Because the Manager Access Group references both roles, members of the Access Group can approve and submit time-off requests.

Pega Platform handles conflicting permissions for an access group by applying the most permissive permission for an action, such as approving a time-off request.