Modules declare their own roles
CIAS does not invent roles. Each module knows best which rights it needs and declares its roles, the user attributes it requires and the sign-in levels it expects. CIAS takes this into its role catalogue and decides how a role is granted and who may pass it on.
Reconciliation with the identity provider creates new roles but never deletes and never grants. If a module stops declaring a role, it is retired rather than deleted. What a role permits on the data is decided by the application – CIAS deliberately keeps no copy of it.
Delegation and ceiling
A platform administrator may grant any role. Everyone else only when four conditions hold at the same time:
- The role is a tenant role, not a platform role.
- Its delegation releases it to one of the granting person’s roles.
- It is granted within the person’s own tenant.
- The granting person holds the role there themselves – the ceiling.
Global, per tenant or time-limited
A role can apply to the whole installation or only within a particular tenant. A person can therefore hold different rights in one tenant than in the next. Platform-wide roles such as platform administration cannot be declared by any module or granted by any tenant.
Grants may have a start and an end – for a project, a holiday cover or from the first working day. CIAS enters the role in the identity provider only when it starts and removes it once it ends. Every grant records who issued it, when, in which tenant and for what reason.
Attributes are rights too
An attribute such as “region = north” narrows the rows that are visible in Data Management. One more value means more reach. That is why attributes follow the same rules: delegation per attribute and a ceiling for values. Someone who only sees “north” cannot give anyone “south”.
If a person works for several tenants, an attribute can have its own value per tenant – region north in one, south in the other. On every request, CIAS applies the value of the active tenant.
Roles on day one
Which roles a newly registered person receives is defined by a rule set – separately for three situations: they found a tenant, they join an existing one, or they remain without a tenant. A tenant’s rule replaces the installation’s rule rather than adding to it. Whoever writes such a rule must hold every role in it themselves.