Enabling row-level security by defining security labels

To create a security label

1. Log in to the BMC Helix Innovation Studio, navigate to the Workspace tab, and select the application.
2. On the Records tab, navigate to the record definition for which you want to create the security labels.
3. Click the Edit  icon in the Properties pane on the right side, and in the Security Labels section, click Add/Remove Security labels.

4. In the Add/Remove Security Labels window, enter the values for the following fields:

   Field	Description
   Security Label	Enter the name of the security label.
   Ancestors Security Label	Select the security label you want to assign as the parent security label. This creates a hierarchy of security labels that is used for permissions inheritance. A parent label can only have one child label. For more information, see Parent security label.
   Descendants Security Label	Select the security label you want to assign as a child security label. This creates a hierarchy of security labels that is used for permissions inheritance. A child label can only have one parent label.
   External Field	The external record ID field is applicable only for the external record definitions. Enter the external record field name.  Selecting the value for this field automatically populates the External Field ID field. The external fields in the External Record Definition are not available for selection as security label fields.
   External Field ID	The external record ID field is applicable only for the external record definitions. Maps the External Field ID to the Security Label and stores the security label data in the external data source. Selecting the value for this field will automatically populate the External Field field. Important: The external fields in the External Record Definition are not available for selection as security label fields. While designing an external record definition, if you want to enable security label, the field which stores the security label must be added on the external record definition.

   To add more security labels, repeat this step.
   

5. Save the changes and save the record definition.

After you add the labels, you can use the labels in the Rule designer and Process designer.

Parent security labels and permission inheritance

The parent security label allows permissions inheritance. A parent security label can have one child security label, and each child security label can only have one parent security label. A child security label can also have a child security label of its own, forming a multilevel hierarchy. In a multilevel hierarchy, assigning permission to a child security label grants access to all ancestor security labels, such as the parent security label of a parent security label.

For example, in the following image, the security label named Parts Supplier is a parent to the Dealer, and an ancestor to Shop A1 security label:

Security label hierarchy

Using security labels in setting permissions

When you assign the permissions to a field in a record definition, the security labels are listed as a section of available groups. All the security labels for the record definition are listed in alphabetical order by name. The parent and child labels are listed at the same level. You can use the security labels like groups for assigning permissions.

The following image shows a sample Edit Permissions screen:

Setting the security labels in rules and processes

In the Rule designer and Process designer, you can set an action to populate the security label field.