Access the Security Console through the Welcome Springboard > Navigator Menu > Tools Functional Security Overview
Job and Duty Roles grant access to functionality:
A Duty Role grants access to privileges required to complete a specific task, or a set of related tasks.
A Job role combines duty roles required to grant access to a broad range of tasks.
You can assign job roles to users. In combination, the job roles assigned to a person encompass all that he or she is hired to do.
You cannot assign duty roles directly to users. A User is granted duty role indirectly as components of job roles.
You work with Risk Management roles in the Security Console.
Seeded Roles have the Prefix of "ORA" in their Codes. These cannot be modified but can only be duplicated. In the below screenshot we see two entries for Accounts Payables Manager, but one of them is a seeded Role and the other is a Customized Role:
Roles can also be viewed Graphically:
Editing a Role
Function Security Policies
Data Security Policies allow a role to work with a specific Business Unit or a Ledger
Role Hierarchy
Segregation of Duties
Users. Directly Assign the role to a specific User
Role Administration:
Set Role Preferences such as Prefix for Copied Role Name and Code
Copy Role Status for copied seeded Roles
Bridge for Active Directory
Role-Assignment Strategies
More than one mapping of duty roles to job roles may correctly grant functional access to a user.
You may create a single job role for a given user. For it, you would select all the duty roles the user needs.
You may assign multiple job roles to a given user. Each would contain a subset of the duty roles the user requires.
The second approach is recommended because it gives greater flexibility. Each job role remains available for assignment to other users in varying combinations with other job roles.
A Perspective is a set of related, hierarchically organized values. You can
Create other perspective hierarchies
Assign perspective values to processes, risks, models, controls, and incidents
Assign perspective values to data security policies
Use perspectives as a filter for searching and reporting
Perspectives are used for filtering/security and control rights. These are hierarchy of values that can either be based on your Organizational structure , Regulatory compliance, Geographic Location or Processes.
Before a perspective hierarchy is available for use, you must associate it to Module Objects. These Modules are
Below is a quick demonstration of Assigning perspectives to Module Objects:
You cannot add more modules, but you can modify them according to your business needs
After assigning a perspective to a module object, you would need to run a couple of jobs. Jobs are individual requests to synchronize data, evaluate models or advanced controls, export results, generate reports, or perform other background tasks. You run a job on the page to which the job applies, but you manage it in the Monitor Jobs page. You can:
See the current status of the job
Manage files created by the import or export jobs
Cancel some jobs
Purge the Job History
A perspective filter may use an "Includes Children" condition. If so, it grants access to objects tagged with a perspective value you select for the filter, or with any of its child values.
A single perspective filter may select more than one perspective value. If so, those values have an OR relationship. The filter grants access to objects associated with any of the values.
A data security policy may include multiple perspective filters. If so, they have an AND relationship. The policy grants access only to objects associated with values selected by all the filters.
Seeded Roles have the Prefix of "ORA" in their Codes. These cannot be modified but can only be duplicated. In the below screenshot we see two entries for Accounts Payables Manager, but one of them is a seeded Role and the other is a Customized Role.
You can copy a seeded role from the Security Console. Below is a quick demonstration of Copying a Seeded Role:
