1. Setting up Privilege Management with Signet Metadata

3. 3 Distributed Access Management CAMP Privileges Building Blocks Functional view Subsystems Categories Functions Scope, Limits Prerequisites & Conditions System view Subject Action Resource Privileges → Permissions

4. 4 Distributed Access Management CAMP Signet Components Define domains of ownership and responsibility Reflect real world boundaries Can be large or small Financial system Student Administration HR system Network access management Research administration Clinical resources Programmatic resources Collaboration resources Subsystems

5. 5 Distributed Access Management CAMP Functional View Signet configuration declares … Limits Qualifiers, constraints for a privilege Limit types Limit choice sets Scope Trees Organizational hierarchy governing distributed delegation Functions The things a person can do; what they are getting privileges for Categories Provide useful arrangement of functions within a subsystem; for reporting, ease of use

6. 6 Distributed Access Management CAMP Functional View Categories Functions Subsystems Clinical Trial Protocol A Patient Records Materials Control Manage Grant Lab Access Admin Student Admin Course Support Add/Drop students Schedule Classes Process Applicants Award Scholarships Manage Accounts Financial Aid Limits Which term From Fund… Read/Write Hours For school… For fund… Which campus Qty/day $ constraints organizing actions

7. 7 Distributed Access Management CAMP Systems View Permissions Atomic units of control that map to specific access rules in systems Includes limits that must be evaluated when interpreting permissions Resources The target of a specific privilege; things that have access rules to control their use

8. 8 Distributed Access Management CAMP Functional View  Permissions Resources/Permissions Student Admin Functional View Course Support Add/Drop students Schedule Classes Process Applicants Award Scholarships Manage Accounts Financial Aid reserve_time view_schedules student_records applicant_data view_fund_data update_fund_data update_course_data reserve_room Calendar Course Facilities Financial Student categoriesfunctions

9. 9 Distributed Access Management CAMP Privileges Lifecycle Conditions Provides automatic revocation of privileges Date controls -- from date, until date Will be based on person’s status, affiliation, etc. e.g., as long as person is at Stanford Prerequisites Pre-conditions that must be met to activate privileges e.g., training

10. 10 Distributed Access Management CAMP Other features Assignments can be To an individual To a Group With/without ability to further delegate Distributed delegation using organizational hierarchy Records “chain of command ” Proxy assignment Temporary granting of one’s privilege to another