Business Context:

Your organization manages agreements with different sensitivity levels, involves multiple teams, and spans many customer accounts. You want to ensure:

• Legal users can access all non-confidential agreements.
• Contract Facilitators can always access the agreements they handle.
• Sales users can access the agreements tied to the accounts they own or manage.
• Compliance users can exclusively access agreements classified as Restricted.

You want a unified and scalable access model without creating multiple complex roles.

Overview:

The Advantage Platform uses Role-Based Access Control (RBAC) to define object and field access. You can extend RBAC with additional scope controls to refine record-level access:

• Global Scope: grants criteria-based access across all records
• User Scope: grants access based on the user being tagged on the record
• Account Scope: grants access to records tied to accounts the user owns or is associated with
• Property Scope (PBAC): grants access based on business properties such as classification or group

These scopes work independently and do not override one another. Instead, the system evaluates each scope to determine whether a user can access a specific record.

Scenario:

You want to configure access as follows:

• Legal Team: Read all agreements that are not confidential
• Sales Team: Access agreements related to the accounts they own or are assigned to
• Contract Facilitators: Access agreements where they are assigned as the facilitator
• Compliance Team: Full CRUD access only for agreements with ContractGroup = Restricted, based on PBAC

This scenario shows how to combine all access layers within a single model.