Privileges

Privileges are individual actions a user can perform on containers, documents, or the iManage Work system. There are a set number of privileges defined by the iManage Work system. Privileges cannot be created or deleted. They can be only granted or denied. Privileges are contained only in roles. Roles are named sets of privileges. The roles are then assigned to users. There are categories, that include p rivileges for individual container or documents, such as Create/Import content as files, Delete content as files, and Create Public Workspaces, among others. Privileges or actions implemented for the iManage Work system include Search Using Web to allow a user to perform Web searches, Allow Full-Text Searches to search using full text, or Tier 2 to allow that user tier 2 help support functions.

Privileges are divided into the following categories based on the operations performed:

• Content: Privileges to work with the documents.

• Folder: Privileges to work with the folders, tabs, and workspaces.

• Administrative: Privileges to work with the administrative tools.

• Web Operations: Privileges to perform operations through the iManage Work Web client application.

For a detailed list of privileges that can be assigned to users, see Roles.

Roles

A role enables you to group a set of privileges. When you create a role, you then assign to one or more users to the role.

For more information, see Roles.

Roles can be created, deleted, or modified as required, with the exception of the Default role; see Default Role. A role's privilege set may be changed at any point later by an NRTADMIN.

• Default role: iManage Work automatically creates a Default role. This role cannot be deleted and the iManage system administrator can edit that set of privileges at any time . All users are automatically assigned to this group and they cannot be deleted from it. As a result, each user will have a default set of privileges, typically minimal for security reasons .

• Owner/operator: The owner, also called the operator, is a role that is automatically assigned to the user who creates a new document or initially uploads a document. That user has Full Access privileges to the document. A document can have only one owner at time, and the current owner can assign the role to another user.

• Author: An author of a document is role that is assigned by the document's owner. It does not grant ownership to the document (see Owner) but grants Read/Write access to the document. This is identical to the access level of Read/Write. However, the owner can grant or deny this level directly and does not have to change other settings.

Groups

Groups are collections of multiple users. Groups can be assigned to workspaces, folders and tabs, and documents, and with a specific access permission. This allows that a precise set of users can be assigned to the same item and all with the same access permission. Groups can be maintained by adding or removing users, or changing the access permission, rather than modifying individual users and their access permission. Users can be member of multiple groups.

Groups do not have access privileges assigned to them. Keep in mind that each user will be assigned a role (which does have associated privileges) and that this role is independent of being assigned to a group.

Groups can be created, and modified as required, with the exception of the NRTADMIN group. See NRTADMIN Group for more information. Groups cannot be deleted.

If the directory server from which the user list is maintained already includes groups, those groups and members can be imported into iManage Work. This is a one-way synchronization only; groups and memberships cannot be updated from iManage Work back to the directory service.

Using groups on security access permissions instead of individual users also has an implicit performance improvement for searching. When using groups to manage security, the object's security only has to be indexed once in the indexer when the group is assigned. Changes made to the underlying group do not trigger a reindex. Whereas if you managed user security individually on the objects, each change would require the object to be re-indexed.

Security access levels

Security access level is a term that collectively refers to default security and access rights. Security access levels define the access a user has to the content of containers and to documents.

See Container and Document Security for additional information.

Access conflict models

An access conflict is when a user has conflicting or contradicting access to an object, such as a container or document.

Depending on your iManage Work environment, one of the following models is used to resolve access conflicts:

• An optimistic model resolves conflicts by applying the most permissive access level from among the conflicting levels.

• A pessimistic model resolves conflicts by applying the most restrictive access level from among the conflicting levels.

• A hybrid model uses the optimistic model unless any of the conflicting access levels are No Access. If one of the security access level conflicts on the object is No Access, the user is revoked access for the object.
  Refer to the examples below for more information about these different models.

For iManage Work in the Cloud, contact cloudsupport@imanage.com to confirm which security model is applied in your environment.

For iManage Work in an on-premises environment, refer to the following registry key setting in the iManage Work Server:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Interwoven\WorkSite\imDmsSvc\

Name: Security Model
Values:
0 – Optimistic Security (Default)
1 – Pessimistic Security
2 – Hybrid Security