CA PPM Access Rights Reference

System administrators can use access rights to assign read or write privileges to users for features and functions, including the ppmnew. For example, assign portfolio managers Portlet - View instance rights so users can access the portfolio pages. Assign Portfolio - Edit - All global rights so users can edit all portfolios.
ccppmop1541
HID_ref_access_rights
System administrators can use access rights to assign read or write privileges to users for features and functions, including the 
New User Experience
. For example, assign portfolio managers 
Portlet - View
 instance rights so users can access the portfolio pages. Assign 
Portfolio - Edit - All
 global rights so users can edit all portfolios.
You can assign access rights at these levels:
  • Instance
    Provides access to object instances. For example, a specific portfolio, rather than all portfolios.
  • Organization Breakdown Structure (OBS) Unit
    (Not typical for user groups.) Provides access rights to all instances having the selected OBS unit.
  • Global 
    Provides unlimited access to an object. For example, all portfolios rather than a specific portfolio.
The same levels apply when you assign access rights for the pages and portlets included in an optional add-in.
: For new deployments, the default admin user includes a subset of rights to administer the application; however, this user is not a
superuser
with full access to all features. To create a superuser, assign all global access rights to a
resource
(the admin user). To create multiple superusers, assign all global access rights to a
group
such as System Administrator. Then, assign one or more resources (the admin users) to the group.
 
2
Assign Instance-Level Access Rights to a Resource
You can assign a resource instance-level access rights to a specific object, such as to a page or project.
Follow these steps:
  1. Click
    Administration
    ,
    Organization and Access
    ,
    Resources
    .
  2. Click a resource name.
  3. Open the
    Access Rights
    menu and click
    Instance
    .
  4. Click
    Add
    .
  5. Select the object from the drop-down list and click
    Next
    .
  6. Select the access rights that you want to assign to the user, and click
    Add and Continue
    .
  7. Select the specific instances that this user can access and click
    Add
    .
Assign Instance-Level Access Rights to a User Group
Assign instance-level access rights to provide access to specific object instances. For example, assign portfolio managers instance-level access to the Portfolio portlet pages so they can work with portfolios.
Follow these steps:
  1. Click 
    Administration
    Organization and Access
    Groups
    .
  2. Click a group name.
  3. Open the 
    Access Rights
     menu and click 
    Instance
    If the user group is new, no access rights appear.
  4. Click 
    Add
    .
  5. Select an object from the drop-down list and click 
    Next
    .
  6. Select the access rights to assign to the user group and click
    Add and Continue
    .
    If more access rights are available on additional pages, select the access rights and click Add and Select More. Continue assigning access rights until all appropriate access rights have been assigned.
  7. Select the instances that you want by clicking the corresponding check boxes and click
    Add
    .
    If more instances are available on additional pages, select the instances and click Add and Select More. Continue assigning instances until all appropriate instances have been added.
  8. Complete one of these steps after you have finished assigning instance level access rights to the user group:
    • Click
      Continue
      to add global access rights, if the user group needs access rights for all instances of an object.
    • Click
      Return
      to go back to the Groups page.
After you assign instance-level access rights to a user group, you have successfully created a user group with access rights. The users in the group can now perform their assigned tasks.
Assign Global-Level Access Rights to a User Group
Assign global access rights for all instances of an object to system administrators or super users so that they can perform both end-user and administrative functions. For example, assign a user group, named
Portfolio - Managers
, global access rights to the Portfolios object. With this access, group members can create, edit, or remove portfolios.
Follow these steps:
  1. Click 
    Administration
    Organization and Access
    Groups
    .
  2. Click the group name.
  3. Open the Access Rights menu and click Global.
    If the user group is new, no access rights appear.
  4. Click Add.
  5. Select the appropriate global rights for the user group and click Add.
  6. If more access rights are available on additional pages, click Add and Select More. Continue assigning access rights until all appropriate access rights have been assigned.
  7. When you have finished assigning global rights to the user group, click Return.
    After you assign global access rights to a user group, the users in the group can now perform their assigned tasks.
Filter for Specific Access Rights
You can assign a group of access rights (for example, all roadmap access rights for the 
New User Experience
) to a user. You can filter for these access rights and avoid browsing through pages of access rights.
Follow these steps:
  1. Click 
    Administration
    Organization and Access
    Resources
    .
  2. Click the last name link for the user.
  3. Click
    Resource's Access Rights
    and select
    Global
    .
  4. Click
    Add
  5. In the
    Description
    field in the filter section, enter a description for the access rights. Use wildcard asterisks (*) before or after (or both) to return matching results. For example, enter the following value to search for all access rights for the Roadmaps feature:
    *roadmap*
  6. Click
    Filter
    .
 
: Another popular example is to assign XOG global access rights to a user. Perform the same steps and enter
*XOG Access
in the Access Right field and click Filter. Select the appropriate XOG access rights and click Add.
Auto-Access Rights
Auto-access rights are granted automatically when you are assigned to a role or when you perform a certain action. For example, if you are assigned as a project manager, you are automatically given the 
Project - Manager (Auto)
 access right. This right allows you to view and edit the general and management properties of the project.
To view the list of access rights for a resource (user), click Administration, Organization and Access, Resources. These rights become visible in a resource’s list of assigned access rights only after the condition is met. If you are removed as the project manager, then this auto-access right is removed.
The application provides these auto-access rights:
  • Application - Manager (Auto)
    This right is equivalent to 
    Application - Edit
    , and is automatically granted to an Application Manager.
    Type:
     Application
  • Asset - Manager (Auto)
    This right is equivalent to Asset - Edit, and is automatically granted to an Asset Manager.
    Type:
     Asset
  • Idea - Initiator (Auto)
    Automatic right that is granted to the initiator of an idea.
    Type:
     Idea
  • Idea - Manager (Auto)
    Automatic right that is granted to the manager of an idea.
    Type:
     Idea
  • Job Type Creator (Auto)
    This right is automatically granted to the creator of a job type when it is created.
    Type:
     Job
  • Other Work - Manager - Automatic
    Automatic right that is granted to the manager of Other Work; equivalent to Other Work - Edit.
    Type:
     Other Work
  • Page Creator (Auto)
    Allows a user to edit a page.
    Type:
     Page
  • Portfolio - Owner (Auto)
    Automatic right that is granted to the owner of a portfolio.
    Type:
     Portfolio
  • Portfolio - Stakeholder (Auto)
    Automatic right that is granted to a stakeholder of a portfolio.
    Type:
     Portfolio
  • Portlet Creator (Auto)
    Allows a user to edit a portlet.
    Type:
     Portlet
  • Product - Manager (Auto)
    Allows a user to baseline all products. This right does not include the Product - Navigate right, and requires the user to have the Product - Edit right.
    Type:
     Product
  • Project - Discussion Manager (Auto)
    This right is automatically created for the user who creates a project, and makes the creator of the project the Collaboration Manager. The user can subsequently grant Collaboration Manager rights to additional resources or revoke this right by changing it to participant.
    Type:
     Project
  • Project - Manager (Auto)
    The user who enables a project for management is automatically granted this right. The user becomes the Project Manager for the project. This right allows a user to view and edit the general and management properties of the project. The access right allows the user to edit only some limited financial fields.
    Type:
     Project
  • Project - Participant (Auto)
    A user who is assigned to a project as a project participant is automatically assigned this right. The right allows the user access to Action Items, Project Calendar, Document Manager, and Discussions. This right includes the Project - View right. The right does not include the access to view tasks.
    Type:
     Project
  • Project - Participant Groups (Auto)
    Type:
     Project
    A user who is assigned to a project through a project group is automatically assigned this right. The right allows the user access to Action Items, Project Calendar, Document Manager and Discussions.
  • Release - Manager (Auto)
    Automatic right that is granted to the manager of a Release.
    Type:
     Release
  • Release Plan - Manager (Auto)
    Automatic right that is granted to the manager of a Release Plan.
    Type:
     Release Plan
  • Requirement - Manager (Auto)
    Automatic right that is granted to the manager of a Requirement.
    Type:
     Requirement
  • Resource - Manager (Auto)
    The user creating a new resource is automatically granted this right. The user becomes the resource manager for the resource. This right allows the user to view and edit general resource properties. If the resource is assigned another resource manager, the current resource manager loses rights to the resource.
    Type:
     Resource
  • Resource - Self (Auto)
    Rights that are automatically granted to a resource when created and includes Resource - Edit Ideas.
    Type:
     Resource
  • Scenario - Creator (Auto)
    This right includes Scenario - Edit and Scenario - Edit Access Rights, and is automatically granted to the Scenario creator.
    Type:
     Scenario
  • Service - Manager Auto
    Automatic right that is granted to the manager of a service.
    Type:
     Service
Auto-Access Rights in the 
New User Experience
  
  • Project - Manager (Auto)
     Automatic right that is granted when a user creates a project in the
    New User Experience
    .
  • Resource - Manager (Auto)
    Automatic right that is granted when a team member is assigned a resource manager in the
    New User Experience
    . The right includes both soft and hard booking rights for the team member.
Basic User Group Access Rights
The 
Basic group for user access
 is a group that every user is automatically assigned to when they are added to
Clarity PPM
. The members of this group automatically inherit the access rights of the group. By default, all users are members of the group 
Basic group for user access
, which provides these access rights:
  • Account Settings - Navigate
    Users can navigate to the Account Settings page.
    Type:
     Global
  • Organizer - Access
    Users can access the Organizer page and the Actions, Events, and Notifications portlets available from the Organizer page.
    Type:
     Global
  • Projects - Navigate
    Users can navigate to the Projects list page and to the My Projects portlet.
    Type:
     Global
Basics User Access Rights
Audit Trail Access Rights
The following access rights are available for audit:
  • Audit Trail - Access
    Allows users to access audit page.
    Type
    : Global
  • Audit Trail - View - All
    Allows users to view any audit page.
    Type
    : Global
Dashboard Access Rights
The following access rights are available for dashboards:
  • Dashboard - Create
    Allows users to create new dashboards in Classic
    Clarity PPM
    Type: 
    Global
  • Dashboard - Navigate
    Allows users to navigate to any dashboard page in Classic
    Clarity PPM
    Type: 
    Global
Knowledge Store Access Rights
Access to the Knowledge Store and to its folders and documents are provided at the following levels:
  • Access rights at the Knowledge Store level
  • Permissions at the folder and document levels
The following access rights are required to manage or view content in the Knowledge Store:
  • Knowledge Store - Administrate
    Allows you to access all of the folders and documents in the Knowledge Store. Only users with the Knowledge Store - Administrate access right can create folders at the top level of the Knowledge Store folder tree. Users with the Knowledge Store - Access right and with the appropriate permissions can add sub folders and documents to the folders.
  • Knowledge Store - Access
    Allows you to create, edit, and view documents and folders in the Knowledge Store to which you have access. Allows you to delete the folders you created, and the documents you added.
  • Knowledge Store - View All
    Allows you to view all documents in the Knowledge Store.
Page Access Rights
The following access rights are available for pages:
  • Page - View
    Allows users to view a general page in 
    Clarity PPM
    . For instance pages (such as portfolio pages), this right is not required.
    Type: 
    Instance
  • Page Definition Editor
    Allows users to edit, view, and delete the definition of a specific page. 
    Required:
    Administration - Studio
     access right to access the Studio menu.
    Type: 
    Instance
  • Page Definition Editor - All
    Allows users to edit, view, and delete the definition of all pages. 
    Required:
    Administration - Studio
     access right to access the Studio menu.
    Type:
     Global
  • Page Definition Viewer
    Allows the user to view the definition of a specific page.
    Required:
    Administration - Studio
     access right to access the Studio menu.
    Type: 
    Instance
  • Page Definition Viewer - All
    Allows the user to view the definition of all pages.
    Required:
    Administration - Studio
     access right to access the Studio menu.
    Type: 
    Global
  • Page Viewer - All
    Lets the user view any configured portlet page. Before the users can view them, link the portlet pages to a menu. The user requires the rights to navigate the menu. For example, if a page links to the Administration menu, the users require the 
    Administration - Access
     right.
    Type: 
    Global
Report and Job Access Rights
The following access rights are available for users who run and review reports:
  • Reports - Access
    Allows users to access reports pages and the My Reports portlet. This access right is dependent on one of the following access rights being granted to a user:
    • The 
      Reports - Run - All
       access right
    • Instance level access rights such as 
      Report - Run
      Report - View Output
      , or 
      Report - Edit Properties
    Type
    : Global
  • Reports - Run - All
    Allows users to run any report. This right also allows users to schedule, edit properties, and view the output of any report. 
    Requires:
    Reports - Access right
    Type: 
    Global
  • Reports - View Output - All
    Allows users to view the output of any report. 
    Requires: 
    Reports - Access right
    Type: 
    Global
  • Reports and Jobs - Administrator Access
    Allows user to view report and job definitions. The right also allows user to view the reports and jobs categories.
    Type: 
    Global
  • Reports and Jobs - Create Definition
    Allows user to create, edit, and view report or job definitions.
    Requires
    : Report and Jobs - Administer Access 
    Type: 
    Global
  • Reports and Jobs - Edit Definition - All
    Allows user to edit any report or job definition.
    Requires
    : Report and Jobs - Administer Access 
    Type: 
    Global
  • Report - Run
    Allows users to run specific reports, edit scheduled report properties, and review output. 
    Requires:
     Reports - Access right
    Type: 
    Instance
  • Reports and Jobs - Edit Definition
    Allows the user to view and edit a report or job definition.
    Requires
    : Report and Jobs - Administer Access
    Type: 
    Instance
Software Download Access Rights
The following access rights are available for downloading software:
  • Software Download - Microsoft Project Interface
    Allows users to download the CA PPM Microsoft Project Interface.
    Type: 
    Global
  • Software Download - Open Workbench
    Required to download Open Workbench.
    Type: 
    Global
Timesheet Access Rights
The following access rights are available for timesheets:
  • Timesheets - Navigate
    Allows you to navigate to timesheet pages.
    Type
    : Global
  • Timesheets - Edit All
    Allows users to edit all timesheets.
    Type:
     Global
  • Timesheets - Approve All
    Allows users to approve all submitted timesheets.
    Type:
     Global
  • Resource - Enter Time
    Allows users to complete and submit timesheets for a specific resource.
    Type
    : Instance
  • Project - Edit Project Plan
    Allows users to add unplanned tasks to a specific project when completing their timesheets when they are a team member on the project.
    Type:
     Instance
New User Experience
 Access Rights
The following access rights control what users can do in the 
Clarity PPM
 
New User Experience
. Unless stated otherwise, all of the following access rights are 
global
. For example, some rights are available at the 
instance-level
, as noted.
4
4
New User Experience: Navigation Access Rights
  • Administration - Access
    Allows a user to access the Administration menus in both Classic PPM and the
    New User Experience
    . Users need additional rights to perform individual administrative actions.
  • Classic PPM - Navigate
    Allows a user to navigate to the Classic 
    Clarity PPM
     features from the 
    New User Experience
     main menu.
  • Project Management - Navigate
    Allows a user to navigate to the project management pages in the
    New User Experience
    . The user can only view information for projects to which the user has access.
  • Roadmap - Navigate
    Allows a user to navigate to the roadmap features in the 
    New User Experience
    . Users can only view information for roadmaps to which they have access. To create, edit, or delete roadmaps, users need additional access rights.
  • Staffing - Navigate
    Allows a user to navigate to the resource staffing pages in the 
    New User Experience
    . To use the new resource staffing features, a user also needs resource booking and investment rights.
  • Timesheets - Navigate
    Allows a user to navigate to their own timesheets in the 
    New User Experience
    provided the Timesheets feature is active. Administrators can enable the 
    New User Experience
     timesheets in Classic PPM under System Options.
  • Tasks - Navigate 
    Allows a user to navigate to the Tasks page in the main menu of the
    New User Experience
    . The user can view only their own assigned tasks. With additional rights, a project manager can view the tasks for all their project team members.
New User Experience: Blueprint Access Rights
The following blueprint rights are typically assigned to an application owner, content designer, or administrator. Users assigned these access rights also require the Administration - Access right.
  • Blueprint - Create Copy
    Allows a user to create a copy of any existing blueprint including the Standard Project blueprint. Includes
    Blueprint - View - All
    right.
  • Blueprint- Delete - All
    Allows a user to delete all blueprints except the Standard Project blueprint. Includes
    Blueprint - View - All
    right.
  • Blueprint - Edit - All
    Allows a user to edit all blueprints except the Standard blueprint. Includes
    Blueprint - View - All
    right. The access right allows the user to delete fields or sections in the blueprint, rename the blueprint, associate templates to the blueprint, or mark the blueprint as the default.
  • Blueprint - View - All
    Allows a user to view all blueprints and the names of the associated templates. Also, allows the user to view the published, detailed layout of all blueprints.
New User Experience: Staffing (Resource Management) Access Rights
  • Resource Forecast Rate - Edit 
    Allows users to
     
    view and edit the resource forecast column in the Resources-to-Investments, Investments-to-Resources, and Role Requests views. Also allows users to view the Forecast check box and to edit the Forecast Rate field for a resource or role. Includes the 
    Resource Forecast Rate - View
     right.
  • Resource Forecast Rate - View
    Allows users to
     
    view the resource forecast column in the Resources-to-Investments, Investments-to-Resources, and Role Requests views. To include forecast rate information in the grids in these views, users can select the Forecast check box. Users with this right can also view, but not edit, the Forecast Rate field for a resource or role.
New User Experience: Roadmap Access Rights
  • Roadmap - Author
    Allows a user to view, edit, and delete the roadmap and manage roadmap-specific picklists. User can create views and edit or delete their own views. Also, allows user to create and manage scenarios within a roadmap.
    • When you add a user as an author, the instance right is automatically granted to the user. When you remove a user as the author, the instance right is
      not
      automatically removed. The only way to revoke the right is for the system administrator to remove the right from the resource profile in Classic
      Clarity PPM
      .
    • The system administrator can remove the instance right in Classic
      Clarity PPM
       from a user who is still an author on the roadmap. This is useful for reference purposes in case the user no longer needs access to the roadmap.               
    Type:
    Instance
  • Roadmap - Author
    - All
     Allows a user to view, edit, and delete all roadmaps and manage roadmap-specific picklists. Also, allows the user to create, edit, and delete views for all roadmaps.  
  • Roadmap - Create
    Allows a user to create roadmaps. The creator of the roadmap automatically becomes the author and can edit or delete the roadmap.
  • Roadmap - Edit
    Allows a user to view and edit a roadmap and manage the roadmap-specific picklists. User can create views and edit or delete their own views. Also, allows user to create and manage scenarios within a roadmap.
    Type:
    Instance
  • Roadmap - Edit All
    Allows a user to view and edit all roadmaps and manage roadmap-specific picklists. The user can view roadmaps in the timeline, board, or grid views. This access right also allows the user to create, edit, and delete their own views, and edit data in the roadmap grid.
  • Roadmap - View
    Allows a user to view a roadmap and access the different views (timeline, board, and grid).
    Type:
    Instance
  • Roadmap - View - All
    Allows a user to view all roadmaps and access the different views (timeline, board, and grid). This access right also allows the user to create, edit, and delete their own views, and edit data in the roadmap grid.
  • Roadmap - Delete
    Allows a user to view and delete a roadmap.
  • Roadmap - Delete All
    Allows a user to view and delete all roadmaps and associated roadmap items.