Access Control (Roles and Permission Groups)
The Conga Advantage Platform uses a flexible and layered security model to manage user access across applications. This model is primarily based on Role-Based Access Control (RBAC) and is enhanced with record-level controls, including Property-Based Access Control (PBAC). Together, these capabilities help administrators define what users can do (permissions) and what data they can see or modify (scope control).
RBAC governs access by assigning one or more Permission Groups to a Role. A role represents a functional profile, such as Administrator, Manager, or Standard User, and determines a user's overall capability within the system. For more information, see Role-Based Access Control (RBAC).
PBAC extends RBAC by allowing administrators to control access dynamically, based on the properties of each record, not just user role or ownership. This ensures access is aligned with real-world business rules and data classifications. For more information, see Property-Based Access Control (PBAC).
Roles
- A role is a container for permissions.
- Each role can include one or more permission groups.
- Roles simplify administration by allowing you to assign predefined access sets to users.
Permission Groups
A permission group defines the specific actions a user can perform, including:
- Object-Level Permissions: Access to create, read, update, or delete objects.
- Field-Level Permissions: Access to view or edit specific fields.
- Scope-Level Permissions: Additional controls to restrict record-level access using Global, Account, User, or Property scopes.
Scope Levels in Access Control
While RBAC defines broad capabilities, scope levels determine which data records a user can access. The Conga Advantage Platform provides four scope types within Permission Groups:
- Global Scope: Grants access to records based on simple criteria, without relying on ownership or user relationships.
- Account Scope: Controls which Accounts and related records the group can access.
- User Scope: Controls access based on user-to-user or team relationships.
- Property Scope: Enables access based on specific property values on a record.
How RBAC and PBAC Work Together
- RBAC determines what a user can do (object and field permissions) and which records user can see.
- PBAC determines which records the user can see or modify based on the values of the property fields.
- Permission Groups bridge the two by combining object permissions with scope definitions.
- Roles bring multiple permission groups together to define a user's complete access profile.
This layered approach ensures administrators can configure broad functional access while maintaining fine-grained control over data visibility and security.